Get your secrets into one central tool or platform. Some might see it as counterintuitive to have
one place where attackers know they can find your secrets, but it’s actually much safer to harden
one cluster or a series of redundant clusters instead of having them stored in several different
places with varying styles of management.
A surprising number of organizations don’t even have a central secrets management plan. Some
teams might be using a secrets manager, or rolling their own, but others might have secrets
sitting in version control systems like GitHub. They might have them in Excel spreadsheets or
even a Post-it note under their keyboard. While most of us know those are not good places
to keep secrets, there are plenty of junior developers or other engineers with low security
knowledge that are leaving secrets like AWS keys in plaintext and publishing them on public or
private repositories — and attackers can often find them in both.
