New cheat sheet proposal: Secrets Management

[dominikdesmit]

Hi guys,

At the Open Security Summit 2019 we started working on a cheat sheet for Secrets Management: https://open-security-summit.org/tracks/devsecops/working-sessions/secrets-management/. The results are captured here: https://github.com/dominikdesmit/owasp-secrets-management. I think this would be very relevant also for this project and in terms of visibility.

There is a big need for more guidance around secrets management and currently there are no guidelines from OWASP. With this cheat sheet we hope to fill that gap!

Do you guys think it would be a good idea to put this cheat sheet under this project or should it be a separate one?

Thanks!

1. • improve 2.2 Centralized Approach a bit (into standardized/fit-for-purpose) (see https://github.com/OWASP/CheatSheetSeries/pull/784/files) (@commjoen )
2. • cherrypick https://github.com/dominikdesmit/CheatSheetSeries/blob/master/cheatsheets/Secrets_Management_Cheat_Sheet.md what can be used immediately (@dominikdesmit)
3. • improve 2.5 Auditing (see https://github.com/OWASP/CheatSheetSeries/pull/784/files) (@commjoen - First iteration of 3&4 at #124 #791 )
4. • improve 2.9 Restore and Backup (see https://github.com/OWASP/CheatSheetSeries/pull/784/files) (@commjoen -First iteration of 3&4 at #124 #791)
5. • improve 2.10 Policies (see https://github.com/OWASP/CheatSheetSeries/pull/784/files) (@commjoen )
6. • add 2.11 (metadata) (@commjoen )
7. • to discuss: maybe restructure 2 in order to focus on the basics firsts and split the advanced materials (and more vendor related) from it. (See https://xebia.com/blog/secure-deployment-10-pointers-on-secrets-management/ as well for osme of the topics). will be done post-mvp
8. • write basic outline of 3 (e.g. have filled in what we want to touch per paragraph, then replace this task with detailed tasks and fill in what you can already fill in, with resources linked already, see https://github.com/OWASP/CheatSheetSeries/pull/784/files for notes) (@commjoen ) - WIP @ section 3, 4(WIP), 5, and 7(WIP) of the SMCS #816
9. • write basic outline of 4(e.g. have filled in what we want to touch per paragraph, then replace this task with detailed tasks and fill in what you can already fill in, with resources linked already) (@bendehaan & @commjoen ) - WIP @ WIP @ section 3, 4(WIP), 5, and 7(WIP) of the SMCS #816 / SMCS: evolution & removal (WIP) #822
10. • write basic outline of 5 (e.g. have filled in what we want to touch per paragraph, then replace this task with detailed tasks and fill in what you can already fill in, with resources linked already) (@commjoen ) - WIP @ section 3, 4(WIP), 5, and 7(WIP) of the SMCS #816
11. • write basic outline of 6(e.g. have filled in what we want to touch per paragraph, then replace this task with detailed tasks and fill in what you can already fill in, with resources linked already) (@commjoen , but can use help, see SMCS: evolution & removal (WIP) #822, Cheatsheets Secrets Management: Extended section 6 and 7, and removed 8 #829)
12. • write basic outline of 7 (e.g. have filled in what we want to touch per paragraph, then replace this task with detailed tasks and fill in what you can already fill in, with resources linked already) (@commjoen) - WIP @ section 3, 4(WIP), 5, and 7(WIP) of the SMCS #816 / SMCS: evolution & removal (WIP) #822 / Cheatsheets Secrets Management: Extended section 6 and 7, and removed 8 #829
13. • ~write basic outline of 8 ~(e.g. have filled in what we want to touch per paragraph, then replace this task with detailed tasks and fill in what you can already fill in, with resources linked already) - skipping as part of mvp
14. • write basic outline of 9 (e.g. have filled in what we want to touch per paragraph, then replace this task with detailed tasks and fill in what you can already fill in, with resources linked already) (@thatsjet )
15. • write basic outline of 10 (e.g. have filled in what we want to touch per paragraph, then replace this task with detailed tasks and fill in what you can already fill in, with resources linked already) - removed, possibly come back post mvp
16. • write basic outline of 11 (secret detection) (e.g. have filled in what we want to touch per paragraph, then replace this task with detailed tasks and fill in what you can already fill in, with resources linked already)(@thatsjet )
17. • add further reading at https://gist.github.com/maxvt/bb49a6c7243163b8120625fc8ae3f3cd
18. • sync with ASVS (via opencre in Cheatsheets Secrets Management: Extended section 6 and 7, and removed 8 #829)

[mackowski]

Yes, Yes, Yes :)
I wanted to add secrets management to our roadmap so I am very supportive for this one 👍
After we create it I can link to this CS from other CSs where it will be relevant.

@dominikdesmit can I assign this issue to you?

[mackowski]

Here is also very good resource about tools: https://gist.github.com/maxvt/bb49a6c7243163b8120625fc8ae3f3cd

[dominikdesmit]

@mackowski awesome, yes you can!

[righettod]

All your defensive cheat sheet belong to us :) :) :) . We will be more than happy to include and maintain it into the cheat sheet series house.

[mackowski]

Hey @dominikdesmit are you still working on this? Do you need any help from us?

[righettod]

Hello,

As the issue is assigned since many time and we do not have received any PR for this then we send it back to the backlog and we set it as HELP_WANTED.

Thank you very much in advance for your understanding 😃

[jmanico]

BUMP this is a great idea.

[ykcab]

@mackowski this is one only lists tools, shouldn't this have to be more practical on how to use or implement them into these services

[mackowski]

Yes, this needs to be combined together. In general a lot of work is needed for this but if @ykcab or @dominikdesmit you want to create PR and work on this with us it will be awesome.

[dominikdesmit]

Hey @mackowski, sorry for not responding anymore! I was really busy with some other things. I would like to pick this up again but I would require some help :)

I was also thinking about reaching out to other secrets management experts in the field, maybe people like Armon Dadgar would like to help out as well?

The latest status is here actually: https://github.com/dominikdesmit/CheatSheetSeries/blob/master/cheatsheets/Secrets_Management_Cheat_Sheet.md

Let me know your thoughts @mackowski @ykcab!

[mackowski]

Sure we will help 👍 no worries. I suggest to make a PR here to make it easy to collaborate and share feedback.

CC: @antfie @armon

[ykcab]

Sure, @dominikdesmit. I'll be happy to contribute.

[hacksingh]

I would love to help and collaborate with you folks.

[commjoen]

We have dropped the whole vendor lockin part as that is not very relevant for cloud providers, #816 for WIP (please do NOT merge yet).

[commjoen]

Hi all, as you can tell, we are slowly making progress, but it is quite a lot that has to be written. Can you for now please help reviewing section 3 of #816 :) ? so that we can move ahead with the next sections. We are looking for feedback as well to understand whether the content written is actually helpful :). (if not, we might as well maybe nuke it and start over ^^)

[commjoen]

Anybody wants to help by picking up a task of the list above?

[commjoen]

Hi there, we are now checking if we really need section 8 for the MVP. And will try to close down sections 4 with @bendehaan and section 9 and 11 with @thatsjet . Let's see if we can redivide this work to speed up its writing! MVP time :)

[commjoen]

With #840 the mVP is almost done! When it is merged, we can close this issue i guess? Anything needing to happen to get it from concept version to a production version?

[commjoen]

IT IS ALIVE!

[jmanico]

FANTASTIC WORK TEAM!

[commjoen]

Let's close this in favor of #845, again: thank you for your work everybody!