![\"What](\"https:\/\/devoteam.info\/wp-content\/uploads\/2024\/09\/Specific-Topic-GettyImages-1253805460.png\")
<\/a><\/figure>\n\n\t\t\n\t\tThat\u2019s a great question. Let\u2019s unpack HashiCorp Vault to find out. <\/p>\n\n\n\n
Why do we need centralised key management systems?<\/h2>\n\n\n\n\n- Complex infrastructure<\/strong><\/li>\n<\/ul>\n\n\n\n
The need for sophisticated encryption management systems arose when organisations started moving part or all of their infrastructure to cloud. With the move to more shared, distributed service-oriented infrastructures, the need for orchestration, automation, and integration increased as well. Plus, our modern applications and microservices will often communicate with APIs or services outside of an organisation\u2019s data centre.<\/p>\n\n\n\n
As the Vault website<\/a> explains, \u201cMost enterprises today have credentials sprawled across their organisations. \u2026 Because these credentials live everywhere, the sprawl can make it difficult and daunting to really know who has access and authorisation to what.\u201d <\/p>\n\n\n\nWorkloads have also become \u201cmore and more ephemeral and short-lived,\u201d and therefore, \u201clong-lived static credentials pose a big security threat vector<\/a>.\u201d <\/p>\n\n\n\nAll of these and other factors make safeguarding digital keys tricky. Covering all your bases from a security standpoint becomes tedious. <\/p>\n\n\n\n
\n- Toward better security and compliance<\/strong><\/li>\n<\/ul>\n\n\n\n
Today it\u2019s no longer enough to engineer tight controls in the name of prevention. It\u2019s also about how effectively your company can monitor and how quickly and your company can detect and respond to breaches. The right tools, configured right for your organisation, can help. And when it comes to encrypting keys, HashiCorp Vault is a great choice.<\/p>\n\n\n\n
HashiCorp Vault is open source, self-hosted, and cloud agnostic and was specifically designed to make storing, generating, encrypting, and transmitting secrets a whole lot more safe and simple\u2014without adding new vulnerabilities or expanding the attack surface. In fact, it reduces the attack surface and, with built-in traceability, aids forensics in the event of a compromise. <\/p>\n\n\n\n
Features and benefits: What can I do with HashiCorp Vault? <\/h2>\n\n\n\n
In very general terms, Vault\u2019s use cases include (1) general secret storage in the form of both static and dynamic secrets, (2) data encryption, (3) identity-based access, and (4) key management.<\/p>\n\n\n\n
Let\u2019s dive into some of Vault\u2019s main functionalities. <\/p>\n\n\n\n
\n- Vault can store arbitrary key\/value secrets.<\/strong> It encrypts this information before it stores them. This protects the plaintext version and means that gaining access to the storage doesn\u2019t actually expose the secrets. <\/li>\n\n\n\n
- Vault offers encryption as a service. <\/strong>With its \u201ctransit\u201d secrets engine, Vault can handle cryptographic functions on data-in-transit without storing it. Essentially, this is encryption as a service, where Vault acts as a pass-through. That way, Vault is responsible for encryption\/decryption instead of your application developers, and you can then write that encrypted data to another location, like an SQL database. <\/li>\n<\/ul>\n\n\n\n
This is really helpful in use cases where, say, a web application handles sensitive customer data (like credit card information) and is backed by a database. <\/p>\n\n\n\n
\n- Vault can create dynamic secrets. <\/strong>This is where HashiCorp Vault differentiates itself from other encrypted key value stores. It can generate dynamic secrets, in other words, secrets \u201con demand.\u201d <\/li>\n<\/ul>\n\n\n\n
Here\u2019s what that means.<\/p>\n\n\n\n
A dynamic secret doesn\u2019t get created until it is read. It will be unique to a client, and the credential is automatically destroyed when the lease (e.g., one month, three days, one hour\u2014or whatever you\u2019ve configured) expires. <\/p>\n\n\n\n
You can also set it up so that the dynamic secret is revoked right after it\u2019s used. The benefit here is that you can reduce the lifespan of that credential to just the moment in time that it\u2019s used.<\/p>\n\n\n\n
The ability to generate secrets on demand or \u201con the fly\u201d is helpful because it gives you security in an area that is notorious for leaking secrets in more ways than you can probably think of: applications. <\/p>\n\n\n\n
Applications will often leave secrets in log files or logging systems. Secrets can also be \u201ccaptured in exception tracebacks or crash reports sent to external monitoring systems\u201d or are \u201cleaked via debugging endpoints and diagnostic pages after hitting an error,\u201d says Armon Dadgar, co-founder of HashiCorp<\/a>. The list of potential vulnerabilities goes on.<\/p>\n\n\n\nDynamic secret creation removes the problem of multiple clients\/users sharing the same credential. It also allows you to rotate those credentials manually or set up automatic credential rotation. Having automatic credential rotation in place makes it easy to meet regulatory or compliance requirements. <\/p>\n\n\n\n
\n- Vault supports secret revocation. <\/strong>It allows you to revoke secrets before lease expiry and lets you get specific. Whether you need to revoke single secrets or a \u201ctree of secrets<\/a>\u201d (grouped by user, type, or application, etc.), Vault has built-in support for revocation. <\/li>\n<\/ul>\n\n\n\n
This makes key rolling easier. And since you can get granular, this lets you respond to a breach effectively while reducing or even eliminating downtime.<\/p>\n\n\n\n
\n- Vault keeps a detailed log of all requests and responses.<\/strong><\/li>\n<\/ul>\n\n\n\n
In Vault, every request and response, every process, is audited and authenticated. This means you can trace everything. According to Vault<\/a>, every operation \u201cis an API request\/response, \u2026 the audit log contains every authenticated<\/em> interaction with Vault, including errors.\u201d<\/p>\n\n\n\nIn addition, you can enable \u201cmultiple audit devices\u201d instead of a single audit device within Vault. As such, you can have redundant copies and, more importantly, are able to \u201ccheck for data tampering in the logs themselves.\u201d <\/p>\n\n\n\n
Audit trails are essential to meeting compliance requirements in highly regulated industries. <\/p>\n\n\n\n
How well does HashiCorp Vault integrate with providers and platforms?<\/h2>\n\n\n\n
HashiCorp Vault is open source and cloud agnostic. You can run its Secrets Engines on various cloud platforms, including AWS, Azure, and Google Cloud. You can integrate it with existing workflows<\/a>.<\/p>\n\n\n\nHashiCorp also has its own cloud platform offering Vault as a service. Think of authorization methods and secrets engines within Vault as plugins<\/a>, making this a versatile tool.<\/p>\n\n\n\nVault offers various database capabilities that you can deploy on Cassandra, Couchbase, Elasticsearch, MongoDB and MongoDB Atlas, MSSQL, MySQL, Oracle, Snowlake, and more. The Vault website shows a helpful chart<\/a> outlining database capabilities.<\/p>\n\n\n\nYou can also deploy Vault<\/a> on GitHub, Kubernetes, Microsoft SQL Server EKM provider, and ServiceNow. <\/p>\n\n\n\nWhich major companies are using HashiCorp Vault?<\/h2>\n\n\n\n
HashiCorp Vault has solved secrets encryption and storage challenges for many enterprise-level organisations<\/a>, such as:<\/p>\n\n\n\n\n- Intel<\/li>\n\n\n\n
- Ubisoft<\/li>\n\n\n\n
- Adobe<\/li>\n\n\n\n
- Starbucks<\/li>\n\n\n\n
- Bank of America<\/li>\n\n\n\n
- Citigroup<\/li>\n\n\n\n
- Q2<\/li>\n\n\n\n
- Wayfair<\/li>\n\n\n\n
- eBay<\/li>\n\n\n\n
- Autodesk<\/li>\n<\/ul>\n\n\n\n
Since digital credentials are an essential part of interacting with the digital world, you can imagine Vault being used in every industry\u2014from gaming to e-commerce to education to banking.<\/p>\n\n\n\n
Starbucks deploys Vault<\/h2>\n\n\n\n
As a case example, Starbucks used Vault to solve the unique challenges of their edge environment (which uses a network of data centres placed in hubs to reduce latency for end users)\u2014a complex type of computing common for retail at scale. <\/p>\n\n\n\n
In a video case study<\/a> Andrew McCormick, Lead Systems Engineer at Starbucks, explains, \u201cWe went all the way down the rabbit hole with Terraform and Helm to implement everything as code, from the infrastructure and network all the way down to Vault policy and identity.\u201d This was the first large-scale platform they had built, and they did it with HashiCorp Terraform\u2019s open-source infrastructure-as-code software on Kubernetes.<\/p>\n\n\n\nIn the video, McCormick says the two features within Vault Enterprise that were \u201ccritical for resiliency and scalability\u201d were performance replica and disaster recovery clusters. \u201cVault replica clusters were a significant aspect of our scalability design for three main reasons: (1) they provide a read-only cluster for edge devices to connect to without exposing the primary Vault cluster, (2) they provide horizontal scaling and regional load balancing, and (3) replication filtering enables physical isolation between tenants.\u201d <\/p>\n\n\n\n
To conclude, HashiCorp Vault, as a secrets management tool, can reduce operational complexity for enterprises that work with orchestrated architecture and operate across multiple cloud providers.<\/p>\n\n\n\n
How can I learn more?<\/h2>\n\n\n\n
This article is a part of a greater series centred around the technologies and themes found within the first edition of the TechRadar by Devoteam. To read further into these topics, please download TechRadar by Devoteam<\/a><\/p>\n\n\n\n\n\n<\/span>![\"\"](\"https:\/\/devoteam.info\/wp-content\/uploads\/2024\/09\/digital-solutions.jpg\")
\n<\/p>\n<\/div><\/div>\n<\/div>\n\n\n\n
\n\n\n<\/p>\n\n\n\n
Want to learn more about HashiCorp Vault?<\/p>\n\n\n\n
Check out TechRadar by Devoteam to see what our experts say about its viability in the market.<\/p>\n\n\n\n
The need for sophisticated encryption management systems arose when organisations started moving part or all of their infrastructure to cloud. With the move to more shared, distributed service-oriented infrastructures, the need for orchestration, automation, and integration increased as well. Plus, our modern applications and microservices will often communicate with APIs or services outside of an organisation\u2019s data centre.<\/p>\n\n\n\n
As the Vault website<\/a> explains, \u201cMost enterprises today have credentials sprawled across their organisations. \u2026 Because these credentials live everywhere, the sprawl can make it difficult and daunting to really know who has access and authorisation to what.\u201d <\/p>\n\n\n\n Workloads have also become \u201cmore and more ephemeral and short-lived,\u201d and therefore, \u201clong-lived static credentials pose a big security threat vector<\/a>.\u201d <\/p>\n\n\n\n All of these and other factors make safeguarding digital keys tricky. Covering all your bases from a security standpoint becomes tedious. <\/p>\n\n\n\n Today it\u2019s no longer enough to engineer tight controls in the name of prevention. It\u2019s also about how effectively your company can monitor and how quickly and your company can detect and respond to breaches. The right tools, configured right for your organisation, can help. And when it comes to encrypting keys, HashiCorp Vault is a great choice.<\/p>\n\n\n\n HashiCorp Vault is open source, self-hosted, and cloud agnostic and was specifically designed to make storing, generating, encrypting, and transmitting secrets a whole lot more safe and simple\u2014without adding new vulnerabilities or expanding the attack surface. In fact, it reduces the attack surface and, with built-in traceability, aids forensics in the event of a compromise. <\/p>\n\n\n\n In very general terms, Vault\u2019s use cases include (1) general secret storage in the form of both static and dynamic secrets, (2) data encryption, (3) identity-based access, and (4) key management.<\/p>\n\n\n\n Let\u2019s dive into some of Vault\u2019s main functionalities. <\/p>\n\n\n\n This is really helpful in use cases where, say, a web application handles sensitive customer data (like credit card information) and is backed by a database. <\/p>\n\n\n\n Here\u2019s what that means.<\/p>\n\n\n\n A dynamic secret doesn\u2019t get created until it is read. It will be unique to a client, and the credential is automatically destroyed when the lease (e.g., one month, three days, one hour\u2014or whatever you\u2019ve configured) expires. <\/p>\n\n\n\n You can also set it up so that the dynamic secret is revoked right after it\u2019s used. The benefit here is that you can reduce the lifespan of that credential to just the moment in time that it\u2019s used.<\/p>\n\n\n\n The ability to generate secrets on demand or \u201con the fly\u201d is helpful because it gives you security in an area that is notorious for leaking secrets in more ways than you can probably think of: applications. <\/p>\n\n\n\n Applications will often leave secrets in log files or logging systems. Secrets can also be \u201ccaptured in exception tracebacks or crash reports sent to external monitoring systems\u201d or are \u201cleaked via debugging endpoints and diagnostic pages after hitting an error,\u201d says Armon Dadgar, co-founder of HashiCorp<\/a>. The list of potential vulnerabilities goes on.<\/p>\n\n\n\n Dynamic secret creation removes the problem of multiple clients\/users sharing the same credential. It also allows you to rotate those credentials manually or set up automatic credential rotation. Having automatic credential rotation in place makes it easy to meet regulatory or compliance requirements. <\/p>\n\n\n\n This makes key rolling easier. And since you can get granular, this lets you respond to a breach effectively while reducing or even eliminating downtime.<\/p>\n\n\n\n In Vault, every request and response, every process, is audited and authenticated. This means you can trace everything. According to Vault<\/a>, every operation \u201cis an API request\/response, \u2026 the audit log contains every authenticated<\/em> interaction with Vault, including errors.\u201d<\/p>\n\n\n\n In addition, you can enable \u201cmultiple audit devices\u201d instead of a single audit device within Vault. As such, you can have redundant copies and, more importantly, are able to \u201ccheck for data tampering in the logs themselves.\u201d <\/p>\n\n\n\n Audit trails are essential to meeting compliance requirements in highly regulated industries. <\/p>\n\n\n\n HashiCorp Vault is open source and cloud agnostic. You can run its Secrets Engines on various cloud platforms, including AWS, Azure, and Google Cloud. You can integrate it with existing workflows<\/a>.<\/p>\n\n\n\n HashiCorp also has its own cloud platform offering Vault as a service. Think of authorization methods and secrets engines within Vault as plugins<\/a>, making this a versatile tool.<\/p>\n\n\n\n Vault offers various database capabilities that you can deploy on Cassandra, Couchbase, Elasticsearch, MongoDB and MongoDB Atlas, MSSQL, MySQL, Oracle, Snowlake, and more. The Vault website shows a helpful chart<\/a> outlining database capabilities.<\/p>\n\n\n\n You can also deploy Vault<\/a> on GitHub, Kubernetes, Microsoft SQL Server EKM provider, and ServiceNow. <\/p>\n\n\n\n HashiCorp Vault has solved secrets encryption and storage challenges for many enterprise-level organisations<\/a>, such as:<\/p>\n\n\n\n Since digital credentials are an essential part of interacting with the digital world, you can imagine Vault being used in every industry\u2014from gaming to e-commerce to education to banking.<\/p>\n\n\n\n As a case example, Starbucks used Vault to solve the unique challenges of their edge environment (which uses a network of data centres placed in hubs to reduce latency for end users)\u2014a complex type of computing common for retail at scale. <\/p>\n\n\n\n In a video case study<\/a> Andrew McCormick, Lead Systems Engineer at Starbucks, explains, \u201cWe went all the way down the rabbit hole with Terraform and Helm to implement everything as code, from the infrastructure and network all the way down to Vault policy and identity.\u201d This was the first large-scale platform they had built, and they did it with HashiCorp Terraform\u2019s open-source infrastructure-as-code software on Kubernetes.<\/p>\n\n\n\n In the video, McCormick says the two features within Vault Enterprise that were \u201ccritical for resiliency and scalability\u201d were performance replica and disaster recovery clusters. \u201cVault replica clusters were a significant aspect of our scalability design for three main reasons: (1) they provide a read-only cluster for edge devices to connect to without exposing the primary Vault cluster, (2) they provide horizontal scaling and regional load balancing, and (3) replication filtering enables physical isolation between tenants.\u201d <\/p>\n\n\n\n To conclude, HashiCorp Vault, as a secrets management tool, can reduce operational complexity for enterprises that work with orchestrated architecture and operate across multiple cloud providers.<\/p>\n\n\n\n This article is a part of a greater series centred around the technologies and themes found within the first edition of the TechRadar by Devoteam. To read further into these topics, please download TechRadar by Devoteam<\/a><\/p>\n\n\n\n <\/p>\n<\/div><\/div>\n<\/div>\n\n\n\n <\/p>\n\n\n\n Want to learn more about HashiCorp Vault?<\/p>\n\n\n\n Check out TechRadar by Devoteam to see what our experts say about its viability in the market.<\/p>\n\n\n\n\n
Features and benefits: What can I do with HashiCorp Vault? <\/h2>\n\n\n\n
\n
\n
\n
\n
How well does HashiCorp Vault integrate with providers and platforms?<\/h2>\n\n\n\n
Which major companies are using HashiCorp Vault?<\/h2>\n\n\n\n
\n
Starbucks deploys Vault<\/h2>\n\n\n\n
How can I learn more?<\/h2>\n\n\n\n
\n\n<\/span>\n\n\n\n