3 ms·
Assume that secrets are going to be leaked or discovered and change them regularly. Everything else is a delay tactic, people mess up (or get tricked into messi
by lock-free 6y ago
Assume that secrets are going to be leaked or discovered and change them regularly. Everything else is a delay tactic, people mess up (or get tricked into messing up).
- justin_oaks 6y agoYou can change secrets regularly, but if you don't change them often enough then you can still be compromised because of it. If you change them too often then it's a maintenance problem. You might even take an outage because you have mismatched credentials (i.e. application or database had the database credentials updated but the other one didn't) Changing them regularly IS necessary. So if you're going to do it you should use a credential service like Hashicorp Vault.