Skip to main content

How to Secure Secrets in Multi-cloud Environments

Published Date
Author Kristen Bickerstaff

How to Secure Secrets in Multi-cloud Environments

It wasn’t too long ago that using a single cloud for some business operations was cutting-edge technology. Now the cloud is essential for accelerating growth, improving efficiency and remaining competitive. Most organizations have multiple cloud environments deployed, in addition to private cloud and on-premises environments. In fact, in a soon-to-release CyberArk survey, 85% of respondents said they would be using three or more cloud service providers by 2023. And developers are building more and more applications in the cloud – 71% of organizations are developing cloud-native applications, according to the Enterprise Strategy Group (ESG) 2023 Technology Spending Intentions Survey.

Automation, DevOps and the rise of cloud environments have led to an explosion of machine (or non-human) identities. Applications, cloud workloads, containers, services and other automated tasks – they all require machine identities. And there are a lot of them. The CyberArk 2022 Identity Security Threat Landscape Report found that machine identities outnumber human ones by a factor of 45 to 1.

More Clouds + More Non-human Identities = More Secrets

These non-human identities all use accounts, credentials and secrets to access critical systems and resources and do their jobs. And the number of secrets that need to be managed is growing.

All this means there are more secrets than ever for security teams to keep track of, scattered across a variety of environments – public cloud, private cloud and on-premises – all with their different methods for storing, accessing and managing secrets. Each secret is a potential vulnerability, as attackers can use compromised secrets to access critical systems and resources. The 2022 Uber breach is just one recent example, where hard-coded secrets for a privileged access management (PAM) solution were directly embedded and exposed in a PowerShell script the attacker used to gain admin access to all secrets stored within their system

This becomes a real headache for security teams to manage as organizations continue down the path of cloud migration and other transformation efforts. Not to mention if applications need to be moved from one environment to another, it can become a time-consuming hassle for development and security teams. And many security teams don’t have the bandwidth to either separately manage secrets in each of the environments and tools where they’re stored or implement and maintain a self-hosted secrets management solution.

That’s where SaaS secrets management comes in.

The Five Benefits of SaaS Secrets Management

A centralized, SaaS-based secrets management solution helps ease a lot of the struggles for both the security and development teams working in hybrid or multi-cloud environments.

  • Reduces vault sprawl. When you’re working in multiple clouds or hybrid environments, the number of separate vaults for credentials and secrets can quickly get overwhelming. Rather than security teams hunting for each vault to rotate and manage passwords and having to bring information from a variety of vaults to create an audit trail, a centralized secrets management solution can give you a single pane of glass in which to work.
  • Enables cloud portability. Part of the beauty of the cloud is that developers can build and deploy applications faster than ever. But by relying on the native secrets management capabilities of the platform the application is built on, you’re locked into using that platform. And that becomes an issue if there comes a time when you need to move an application from one environment to another. With a centralized secrets management solution, you can build applications in whichever cloud platform your developers prefer for that specific use case, and move applications from cloud to cloud or from on-prem to cloud without creating a ton of extra work to manage the secrets used in those applications – no need to rewrite apps for a new cloud.
  • Provides a uniform experience for security and developers. Rather than security teams learning multiple different secrets management platforms (which can take time and extra team members), a centralized solution allows security to enforce policies in a unified manner and only operate in one system. This saves time and money on training (from not having to worry about adding additional staff to support every cloud provider), so security can focus on delivering business value.
  • Automates rotation and other security policies. A SaaS-based, centralized solution means that you can automate formerly manual tasks such as secrets rotation and the application of certain security policies. This save security teams time, especially given the vast number of secrets and identities that need to be rotated on a regular basis across multiple different cloud service providers.
  • Speeds up time-to-value and frees up resources. Having a SaaS-based solution means that you can reap the benefits of the cloud with your secrets management software too. Security teams don’t have to worry about operating and maintaining their own secrets management solution (or multiple solutions), but instead can focus their time and attention on the crucial security tasks they need to complete.

Multiple clouds and hybrid environments don’t need to mean extra work for security teams or developers. Centralizing secrets management with a SaaS-based solution can help ease the way and allow the teams to harness the full power of cloud environments.