Secrets Management and DevOps – A Risked-Based Approach to Eliminating Hard-Coded Secrets

Hardly a month goes by without a news cycle of the latest cyber-attacks: from a software supply chain attack, to ransomware, to some kind of personal data exposure. They are so numerous that most people only pay attention when it is a “major” breach or happens to a company they have a relationship with. But more often than not, people are never told what really happened for a number of reasons: the companies involved do not want the negative publicity (they want the whole thing to “just go away”), there is an active criminal investigation, or the problem wasn’t really resolved completely. It is the last reason that may be the biggest source of concern: why would you not try to eliminate a known—and previously exploited—vulnerability from your environment?