April 2024 Summaries

Infisical is deprecating its Service Token and API Key authentication methods in favor of identities, which offer more expansive security controls, including role-based permission systems, IP allowlist capabilities, and short-lived access token properties. The team has released the concept of identities since December 2023, and now plans to move all programmatic access use-cases to identities by July 30th, 2024. Existing tokens created prior to that date will remain usable until July 30th, 2025. Clients are advised to switch from Service Tokens and API Keys to using identities by the deprecation dates, with updated client documentation available for reference.

Microsoft employees exposed internal passwords and credentials to the public on an Azure storage server, which was not password-protected, allowing anyone with access to the internet to view them until March 5th when Microsoft secured the leakage. This incident highlights two major issues associated with poor secrets hygiene: poor secrets storage practice and a slow response from the company. To avoid similar incidents, companies can implement good secrets management practices throughout their development cycle, such as using a dedicated tool like Infisical to store and manage secrets, rotating secrets, and employing tools to detect credentials before they make it public. By doing so, teams can mitigate and prevent secrets from leaking across their development cycle.

Azure Key Vault is a cloud-based service from Microsoft Azure that securely stores and manages cryptographic keys, secrets, and certificates, offering robust access controls through Azure Active Directory and seamless integration within the Microsoft Azure ecosystem. HashiCorp Vault, on the other hand, is a source-available tool for secrets management, encryption as a service, and privileged access management, providing a centralized place to store and access secrets with dynamic secret storage and tightly controlled access. Both solutions offer scalability, performance, audit and compliance capabilities, user experience and ease of use, but differ in their approach, features, and suitability for different organizational needs. Infisical is an open-source alternative that provides a great developer experience, industry-tested by Fortune 500 corporations and international governments, with tight access controls, permissioning workflows, and comprehensive audit logging. Ultimately, the choice between Azure Key Vault, HashiCorp Vault, or Infisical depends on specific organizational needs, infrastructure, and personal preference.

A static database credential is a secret waiting to be leaked, as it provides an indefinite window of opportunity for attackers. This approach is often problematic due to shared credentials increasing overall risk, revocation processes taking time, and difficulty in auditing incidents. The Moving Target Defense (MTD) concept aims to increase uncertainty and complexity for attackers, reducing their window of opportunity and costs. MTD can be applied in web applications using refresh token mechanisms, which reduce the risk associated with leaked access tokens. Secret rotation and dynamic secrets are two moving target approaches that can reduce the window of opportunity for attackers. Secret rotation involves rotating credentials at intervals or on-demand, while dynamic secrets issue unique, short-lived credentials to each engineer or application. Implementing these practices requires a third-party script or tool, such as a secrets manager, to ensure comprehensive visibility and benefits of good secrets hygiene. By employing MTD principles and secret rotation/dynamic secrets practices, organizations can improve their security posture and reduce the risk of exploiting database credentials in the event of a leak.

Infisical has completed a significant migration from MongoDB to PostgreSQL, which has improved the platform's performance, ease of self-hosting, and security. The company has also released a new website with an emphasis on security, versatility, and reliability, as well as support for dynamic secrets, which reduces the risk associated with static database credentials. Additionally, Infisical has introduced two new capabilities in its permission system, allowing users to inherit composite permissions and add temporary access roles. Scoped JWT tokens have also been released, enabling unique resource slugs at the organization level. Furthermore, air-gapped support for Infisical Self-Hosted EE has been added, allowing customers to unlock enterprise features in offline environments. The company has also shipped smaller feature improvements and patches across various areas.