What are secrets & key scenarios for using a secrets manager?

[Music] hello and welcome to cloud tech talks this is pradesh i'm back with another video this video is about the concept of secrets what is secrets management in an enterprise world and why is it important and what are the key scenarios that it comes into play and picture so without further ado let's get started to begin with to understand the concept of secrets let's understand what kinds of secrets there are in an enterprise and followed by that we'll cover some of the key scenarios where the secrets come into picture so i've taken the liberty of classifying the types of secrets in in a few areas doesn't mean that there are only these types of secrets there may be other form of secrets but these are the most used ones and most common ones for foreign enterprise so let's start with the basic uh and the most known secret which is essentially a password right so a password could be password access to a user password could be password access to an application or any kind of a environment that a user puts in to get access to data right that's that's essentially a password second kind of secret is uh could be an api token so an api token essentially allows a company or or a set of infrastructure with specific software uh to access a third party application apis are nothing but a connector which connects a primary application to something which is outside an environment typically needed for a business use case for example a bank would use an api uh you know kind of a methodology to connect to a merchant which could be a third party merchant to let's say process credit card payments right so typically that's how uh apis are defined by use case and uh by third party software which essentially serves a specific business purpose a third kind of secret could be a certificate right so uh it could be any kind of certificate which allows uh essentially a certificate of let's say authenticity for something that a user or an administrator is doing to make sure that everybody in the company or an environment in the infrastructure environment is aware that the the task under operation is actually authorized and it's not being done by someone who shouldn't be doing that uh as an activity right so that's one of the examples of how a certificate can be used uh next one is essentially encryption keys so an encryption key is uh is essentially something that is utilized uh to uh encrypt and then essentially decrypt as well for uh you know for a specific sensitive data in an organization right so it could be credit card information it could be social security numbers or personal identified personally identifiable information for specific individuals customers or even you know employees within the company and that's what encryption key you know is typically used for last but not least there could be something known as database passwords or also used in in any form of application environment database our databases are where most of the information is stored for a given application and it accesses itself through a back end so these passwords essentially allow access for uh the devops engineers or or somebody who's architecting the application to access uh what's in the database right so it could be sensitive information could be storage for all the application that that exists so these are some of the types of secrets which which do exist now to put into context all of these things are extremely important for an organization understand understandably so and this is why you need to manage all of these secrets very efficiently now think about it this way it is not necessary that all of this information is accessed by one single person in the company right it could be a group of people it could be multiple teams within an organization it could even be someone outside the company right let's say you are outsourcing your development to someone outside the outside the company and that company is making software for you then essentially they are accessing a lot of this sensitive information so that's where uh management all of all of this comes into play and that's why you need a a specific solution to manage its secrets and a solution which manages this kind of secret or these kinds of secrets is called a secrets management solution right um now let's flip the story to towards the real life and understand what are the key scenarios where all of this can come into picture for an organization and why is it that it has taken so much of relevance it you know today um to give you a little bit of context in in the traditional world uh before cloud computing and everything else became mainstream uh the uh the way that people used to access secrets was very different right so everything was confined to a specific traditional data center one location and you could physically go and access something right because it was right in front of your eyes now it's not the case anymore so that's where all of these scenarios comes into play and first scenario is essentially the move to cloud so any company who has planned or is planning to move to the cloud uh will typically undergo a scenario where all of this information is sitting in some kind of cloud right so that's where the first scenario for managing secrets comes into play second is when someone has adopted cloud and you need to manage multiple cloud environments or or sort of a environment where there is a multi-public cloud scenario in play that's where this becomes all the more relevant and all the more important because let's assume the first cloud you use is aws second one you use is azure then you have ibm and gcp as well right so all of these cloud providers they would have their own solutions uh for managing secrets but it is not necessary that all of these solutions would work on the other cloud provider solution uh platforms right so that's why multi-cloud becomes one of the most used and most key scenarios where something like secrets management comes into play very often next next up is essentially hybrid environment so a lot of companies still sticking to traditional data centers for a traditional private cloud architecture even modern day private cloud architecture to be able to achieve what they want to achieve without entirely moving to cloud banks financial institutions not everybody is in the public cloud today and there are a lot of compliance regulations that comes into play before they can actually achieve something like this right so for them the best approach is to keep something hybrid where non-sensitive information could be in the public cloud but they have something running on premise so that's where the hybrid scenario comes into play and this is one of the key areas where a secrets management solution can actually make a very big difference and add a lot of value and last but not least you could be dealing about dealing with specific sensitive data and one of the examples for sensitive data could be credit card numbers right or or specific social security numbers for individuals or customers that a bank is managing now in that highly regulated industry it's extremely important that this sensitive information is not exposed to the outside world in any way and all of that information has to be taken care of from a centrally management centrally controlled manager which allows the whole secrets management to uh you know be done efficiently and effectively and none of this should go out uh you know to two parties it shouldn't go out to so in a nutshell this is what uh i wanted to cover off from the perspective of what is secrets what kind of secrets exist in today's world and what are the key scenarios where secrets can come come into play in the following videos i'll cover of uh solutions which cover secrets management so stay tuned for that and for everything else all the uh other solutions i've done about moving to cloud uh dynamic versus uh modern day architecture and the evolution of it evolution of devops devsecops uh i've linked the videos uh in the description below if you haven't already watched it please do and other than that please subscribe to my channel uh for continuing to watch the content and uh stay tuned thank you so much

Channel: CloudTechTalks

Views: 412

Keywords: Hashicorp, Vault, Secrets management, cyberark, beyond trust, password management, HashiCorp Vault, key management

Id: PyqzAj3Db0w

Length: 9min 23sec (563 seconds)

Published: Tue Aug 02 2022