As organizations continue to migrate to the public cloud, security has always been an inherent concern. These concerns usually center around the fact that customers have less control over the underlying hardware and software responsible for running their applications. Organizations frequently find themselves losing oversight into critical operational functions, such as ensuring its equipment is running the most up-to-date firmware, software versions, and security patches in some cases. As a result, IT organizations are consistently looking at different ways to improve their security posture. These improvements can come from multiple sources, including the introduction of new technologies as well as updated processes and procedures

HashiCorp Vault is a security product that offers a wealth of features and options to help organizations secure data. However, organizations can benefit from the introduction of Vault by centralizing critical security functions such as identity management, secrets management, PKI certificates, and encryption. The automation that Vault supports can quickly drive improvements to antiquated policies and procedures, which can help organizations innovate and move faster. Furthermore, by using Vault to centralize and automate these security controls, team members are encouraged to approach security with a different mindset, one that can vastly improve the overall security posture.

Although it's impossible to include all the reasons that IT professionals should learn HashiCorp Vault, the following represents the top 5 reasons I believe will provide the most return on investment as organizations implement Vault in their environment.

1) Centralizing Identity using HashiCorp Vault

Many IT organizations are opting to take advantage of multiple public clouds, whether it's to diversify providers or simply to take advantage of each provider's differentiating services. Consuming services on each of these cloud providers means that organizations now have to manage identities on each one. Federations services usually assist with this; however, many applications still require direct access to the cloud provider, such as an AWS access key and secret key, for operations. Although the access can be limited, these keys are, in many cases, shared among the team, and would need to be rotated to meet security policies or if team members leave the organization. Ideally, nobody would know these credentials, and even more so, the credentials wouldn't even exist until they are needed. This scenario is an area where HashiCorp Vault shines.

Vault supports most of the major cloud platforms out of the box, along with critical services commonly found on-premises, such as LDAP. Organizations can now centralize identity requests to HashiCorp Vault, directing all applications requiring service access to Vault rather than the individual providers themselves. This capability means that applications, or users, can look to Vault for AWS, Azure, GCP, or LDAP credentials, depending on requirements. Centralizing credential management reduces operational complications and allows Vault to manage secrets across all of these identity providers. Using Vault's path-based policies, organizations can also restrict access to these credentials to limited personnel or applications that require service or platform access.

2) Consolidation of Secrets

Admit it; your passwords are everywhere. Personal password Vaults, Jenkins credentials, Chef data bags, text files on your desktop, and sometimes even hard coded. While many of these technologies are somewhat secure, service account credentials are the lifeblood of an application and frequently provide some level of elevated access to systems across the organization. This introduces a few problems to the IT organization. First, storing secrets in multiple places, especially places like text files, limits the ability for these secrets to be programmatically retrieved by team members. The credentials would have to be manually retrieved and submitted, introducing human error and delays. The second is that each application storing secrets now has to be tightly-controlled using role-based access control to prevent access to these credentials. Trying to manage this level of security across multiple applications to prevent unauthorized access increases the complexity of systems along with administrative burden to manage them. As a result, engineers are spending more time managing the tools rather than contributing to projects relevant to the business as a whole.

As you might have guessed, HashiCorp Vault can provide consolidated secrets management for the entire organization. Using the KV (key/value) storage backend, Vault can help organize secrets by department, team, business unit, application, or any other way that makes sense for the respective organization. Vault policies can be created to ensure that the principle of least privilege is followed, and access to secrets is only provided to individuals, teams, or applications that need them for business functions. Additionally, once the secrets are written to Vault, they can be accessed through Vault's UI, CLI, or API, making it simple for the retrieval of secrets.

3) Using Dynamic Credentials

While consolidating secrets should be considered a crucial task, organizations should aspire to get rid of long-lived static secrets altogether. These long-lived secrets can weigh heavily on an organization's shoulders, as they are sometimes hard to contain and manage long term. Many times, secrets aren't very secret. Secrets are shared among team members, secrets are committed in code, and secrets are not rotated as often as they should be. Static secrets are a risk to an organization, a risk that HashiCorp Vault can help resolve.

Not only can HashiCorp Vault store credentials, but it can generate them as well. Being a cloud-agnostic solution, HashiCorp Vault integrates with numerous technologies, from public cloud providers to database platforms. With the proper configuration, users and applications can issue a request to Vault, via UI, CLI, or API, to generate credentials against many of these platforms when needed. These dynamically created credentials have associated leases and definitive TTLs (time-to-live). Once the TTL has expired, so do the credentials. By forcing users and applications to obtain dynamic credentials through Vault rather than use static credentials, secrets don't need to be stored. Secrets don't need to be shared. And secrets automatically expire. Credentials only exist when they are required, and each user or application is issued unique credentials permitting them only the access required.

4) Automate all the Secrets

Every product should have an easy to use, well-documented, and fully-functional API that organizations can use to integrate into an existing automation tool or process. Businesses want to automate the simple stuff so its engineers and architects can focus on solving real problems and helping the organization move forward. When a product doesn't have an API, modern IT organizations will look elsewhere for that integration. Luckily, HashiCorp Vault meets these requirements with its API-first approach.

While other products on the market require additional software for API functionality, all interactions with HashiCorp Vault can be done directly using its API. In fact, most of the UI and CLI interactions simply call the underlying API for the request. Providing a fully-featured API allows Vault to be consumed by automation pipelines and CI/CD tools with little effort. In a world where machine-to-machine communication is vital to organizations, HashiCorp Vault excels

5) Encryption of Data

Data is the lifeblood of most organizations, and protecting it should be a primary concern for any organization looking to survive a network intrusion. Organizations not only need to employ the principle of least privilege to prevent unauthorized access, but data should be encrypted both in transit and at rest. Encrypted data, without access to the keys, makes the data unreadable and useless, and many organizations will use a combination of technologies to encrypt data, such as hardware or software-based solutions. This may include platform-specific technologies, which may not be compatible or similar. Centralizing encryption duties to a solution such as HashiCorp Vault can help organizations standardize and simplify the way encryption is done.

Using Vault's Transit secrets engine, applications can send data to Vault, secured in transit by TLS, and Vault will return the encrypted data to the requester. The data can then be stored anywhere to be later retrieved when needed. By offloading encryption functionality to a solution like Vault, other platforms aren't subject to the performance latency due to heavy CPU usage for encryption and decryption operations.  In addition, all data is encrypted the same way, which can help standardize processes vs. having multiple platforms handle encryption. Organizations can use different encryption keys for each team, business unit, application, or just managing different types of data. The combination of Vault ACL policies and HashiCorp Sentinel can restrict what users, applications, or tokens can encrypt or decrypt data, even down to the IP address of the request.

Summary

While the reasons above aren't exhaustive, it's easy to see why HashiCorp Vault should be an integral piece of an organization's security and automation practice. A deployment of Vault, either open-source or Enterprise, allows businesses to immediately improve its capabilities to move fast while improving its security posture for the foreseeable future. Make sure to give Vault a try, and be open-minded about how its many out-of-the-box features can help your organization.

—Bryan Krausen

Senior Technical Consultant - AWS & HashiCorp