Sherlocked Security – Secrets Management (Vault, KMS)
Secure Design, Review, and Audit of Secrets Storage and Access Mechanisms
1. Statement of Work (SOW)
Service Name: Secrets Management Review
Client Type: Cloud-Native Enterprises, DevOps Teams, FinTech, Regulated Industries
Service Model: Secrets Storage Design Review + Access Control Audit + Secret Hygiene Validation
Compliance Coverage: NIST SP 800-57, PCI-DSS, ISO 27001, SOC 2, HIPAA
Assessment Types:
- Vault / KMS Architecture Review
- Secret Lifecycle Management Audit
- Access Control & Policy Review
- Token Leakage & Secret Exposure Testing
- Secrets Rotation & Expiry Mechanism Validation
2. Our Approach
[Architecture Discovery] → [Secrets Inventory] → [Access Policy Review] → [Exposure Risk Testing] → [Rotation & Expiry Validation] → [Recommendations] → [Optional Retest]
3. Methodology
[Vault/KMS Deployment Review] → [Static & Dynamic Secrets Inventory] → [ACL & Policy Evaluation] → [Access Flow Mapping] → [Secrets Exposure Testing] → [Fix Recommendations]
4. Deliverables to the Client
- Secrets Management Architecture Review Report
- Inventory of All Static and Dynamic Secrets
- Risk-Based Access Control Evaluation
- Secrets Exposure & Leak Report
- Misconfigurations & Hygiene Violations
- Secure Secret Lifecycle Design
- Recommendations for Vault Hardening & Token Handling
- Optional: Revalidation Report After Remediation
5. What We Need from You (Client Requirements)
- Vault/KMS architecture documentation and config files
- Access policies (HCL for Vault, IAM JSON for KMS)
- Inventory of secrets and use cases (static/dynamic/ephemeral)
- User/service role mappings and access logs
- Description of secret injection mechanisms (CI/CD, apps, scripts)
- NDA and scope confirmation
6. Tools & Technology Stack
- Vault (HashiCorp) – OSS & Enterprise
- AWS KMS / GCP KMS / Azure Key Vault
- Boundary / Consul (for service discovery, access control)
- Secrets Detection Tools: Gitleaks, Detect-Secrets
- Auditing Tools: Sentinel, Vault Audit Logs, CloudTrail, Steampipe
- Custom Policy Analysis Scripts (HCL, JSON validation)
7. Engagement Lifecycle
1. Kickoff & Architecture Review → 2. Secrets Inventory & Risk Mapping → 3. Access Review & Token Flow Testing → 4. Exposure Audit → 5. Report + Fixes → 6. Revalidation (Optional)
8. Why Sherlocked Security?
| Feature | Sherlocked Advantage |
|---|---|
| Secrets Lifecycle Expertise | Covers generation, storage, access, rotation, and revocation |
| Policy-as-Code Audit | Evaluate HCL/JSON ACLs, policies, and boundary rules |
| Token Exposure Detection | Secrets leak scanning across codebases and logs |
| Vault/KMS Hardening | Best-practices review and defense-in-depth guidance |
| Integration Advisory | CI/CD, app config, and orchestration integrations reviewed |
9. Real-World Case Studies
FinTech Vault Access Over-Permission
Issue: Developers could read production secrets due to wide-scoped ACLs.
Fix: Role-based segmentation, deny-by-default policies, and time-bound tokens added.
Cloud Startup: KMS Usage Gaps
Issue: Encryption keys not rotated, IAM roles had full KMS access across projects.
Fix: Enabled auto-rotation, implemented key grants, and split access by environment.
10. SOP – Standard Operating Procedure
- Kickoff & Vault/KMS Configuration Collection
- Secrets Enumeration & Exposure Surface Mapping
- Access Policy and ACL Review (HCL, IAM, Role Mappings)
- Secret Access Logging & Token Lifetime Analysis
- Validate Rotation, TTLs, Expiry, and Revocation
- Scan for Leaked Secrets in Code Repositories
- Provide Architecture & Usage Hardening Recommendations
- Deliver Final Report & Support CI/CD Integration (Optional)
11. Secrets Management Checklist
1. Vault / KMS Architecture & Deployment
- Validate high availability & unseal strategy for Vault clusters
- Confirm TLS usage on all Vault/KMS endpoints
- Validate KMS key specs (algorithm, rotation, usage policy)
- Check for plaintext logs or metrics that leak secret values
- Review deployment automation (Terraform, Helm) for hardcoded secrets
2. Access Control Policies
- Evaluate Vault policies (HCL) and capabilities (read/list/create/update/delete)
- Review IAM roles and bindings with KMS access (
kms:Decrypt,kms:GenerateDataKey) - Confirm principle of least privilege (PoLP) for all users and applications
- Test that unauthorized services cannot access secrets outside their scope
- Identify orphaned, unused, or over-permissive tokens
3. Secret Lifecycle Management
- Review static vs dynamic secrets usage patterns
- Check secret TTLs and enforce max TTLs per role
- Validate secret rotation mechanisms for databases, cloud credentials, TLS certs
- Confirm revocation workflows and automation after user offboarding
- Verify expired token revocation actually purges access rights
4. Secret Injection & Usage
- Audit how secrets are injected (env vars, volumes, config files)
- Ensure no secrets are hardcoded in config, Git, or scripts
- Prevent secrets logging via application debug or error logs
- Validate ephemeral credentials usage in short-lived workloads
- Confirm application code handles re-authentication after secret expiration
5. Secrets Scanning & Leak Detection
- Scan repositories for past and current secrets using Gitleaks, TruffleHog
- Alert on commits that contain hardcoded tokens, keys, or passwords
- Search audit logs for secret access anomalies (e.g., volume, timing)
- Integrate pre-commit hooks to prevent accidental commits of secrets
- Monitor public repositories and third-party platforms for leaked credentials
6. Logging, Monitoring, and Auditing
- Enable audit logging for Vault (file, syslog, or socket)
- Monitor token creation, access, and renewal activity
- Set alerts for abnormal usage patterns (e.g., token reuse, volume spikes)
- Ensure CloudTrail is enabled for all KMS key usage events
- Store audit logs securely with immutability and access restrictions
7. Compliance & Best Practices
- Align Vault and KMS policies to NIST 800-57 key management guidelines
- Ensure separation of duties (admin vs secret consumers)
- Implement break-glass access controls and just-in-time access provisioning
- Document key recovery and rotation procedures for incident response
- Provide training for engineers on secret hygiene and handling
8. Reporting & Fix Guidance
- Provide policy diffs with insecure vs secure examples
- Annotate risky tokens or wide-scoped roles with remediation guidance
- Recommend automation for rotation and revocation workflows
- Deliver hardening checklists for Vault server and KMS key configurations
- Map all findings to compliance controls (e.g., NIST, PCI-DSS, SOC 2)