Securely sharing secrets across distributed teams

Infrastructure security is vital to modern software systems. To implement basic security features, developers use various forms of secrets (tokens, API keys, credentials, and more) to control access to different parts of the platform. It’s important to keep secrets secure from external threats, like hackers, but they can cause just as many problems internally as externally.

As development teams grow and change over time and the systems they work on become more interconnected, the complexity of managing secrets within the development pipeline only grows. Keeping track of secrets, staying updated with the correct values of every secret, or making sure there aren’t version mismatches can paint a frustrating picture.

There are solutions, though. Even as the number of secrets grows with additional microservices, tools that help developers securely share secrets across remote, in-person, and hybrid teams exist. Here, we’ll cover some of the most common challenges to sharing secrets between developers and then take a look at possible solutions.

TL;DR

Sharing secrets across distributed teams comes with risks, from version mismatches to insecure messaging. This blog explores common challenges like manual updates and insecure channels, and explains how tools like Doppler can help teams share secrets in real time, securely, and without friction.

What are the biggest challenges to sharing secrets?

Locating secrets: Even with access to every secret, identifying which secrets need to be rotated and the frequency with which they need to be rotated (an assessment of their varying risks) remains a challenge.

Manual storage and sharing: To avoid putting the actual values of secrets directly into code (hardcoding secrets), developers often use environment variables as they work and store the corresponding secrets in different files (.env, for example). The values in the .env are substituted for their respective environment variable at runtime. This way, code can be freely shared between developers without exposing the value of secrets. These files introduce a different problem, though. When secrets are altered, added, or removed from the program, a mismatch of different developers is generated.

This version mismatch requires all developers to update their secrets every time a secret is changed. Even in a small team with few secrets, this update wastes time. If anyone forgets to notify their peers, doesn’t see the notification, or messes up during the sharing process, more time is wasted.

Insecure channels: A developer updates the values of a few secrets and must share those secrets across the team. What’s the best way to send these secrets? Better yet, if this developer regularly rotates secrets (a best practice for reducing the risk of data breaches), how do they efficiently share these updates with the rest of the team?

Hopefully, your team has a secure channel for this update and doesn’t just use plaintext messaging services like email, Slack, Jira, or Teams. Sharing secrets through messaging services is among the most common sources of leaked secrets. If a hacker gets into the secure messaging platform and intercepts a plaintext message containing the values of secrets, they’ve been handed the keys to the platform, quite literally.

Sharing plaintext secrets over insecure channels is well-known as a poor security practice, but it remains commonplace for its convenience. Even in companies with secure channels for sharing secrets, if a developer is updating a couple of values and only needs to share it with one or two team members, using messaging services is an attractive idea for speed. Maybe at the end of the workday, a coworker asks for a specific value. How bad could emailing it be?

Rather than manually sharing secrets between team members, a process that is time-consuming, error-prone, and frustrating, It would be much better to use a system that updates the values of secrets across team members in real time.

How can Doppler help teams securely share secrets?

Locate secrets easily with centralized storage: Doppler is an encrypted, secure, centralized location to store secrets. Its detailed logging features allow teams to track who accessed a secret, when, and what they did with it.

No more insecure channels: Doppler updates secrets in real time through its secure system, eliminating the need for manually sharing secrets. Doppler configs are even more convenient than sharing plaintext files over messaging services, too, and they work just as easily for in-person and remote teams.

Our docs have more detailed instructions on how Doppler can help you secure your secrets across a team of any size.