BR +55 11 3069 3925 | USA +1 469 620 7643

  • BLOG
  • Português
  • BR +55 11 3069 3925 | USA +1 469 620 7643
  • Português
logo senhasegura
  • SOLUTIONS
  • PRODUCTS
  • SERVICES AND SUPPORT
  • PARTNERS
  • COMPANY
  • CONTACT
  • DEMO

Compliance

and Audit

Audit

PCI DSS

SOX

ISO 27001

HIPAA

NIST

GDPR

ISA 62443 |

Industry 4.0

Security and

Risk Management

Privilege Abuse

Third Party Access

Privileged Access Recording

Insider Threat

Data Theft Prevention

Hardcoded Passwords

Password Reset

Solutions

By Industry

Energy and Utilities

Financial

Government

Health Care

Legal

Telecoms

Retail

senhasegura

Testimonials

See Testimonials

360º Privilege Platform

Account and

Session

PAM Core

Domum

Remote Access

MySafe

GO Endpoint

Manager

GO Endpoint

Manager Windows

GO Endpoint

Manager Linux

DevOps Secret

Manager

DevOps Secret

Manager

Multi

Cloud

Cloud IAM

Cloud Entitlements

Certificate

Manager

Certificate

Manager

Privileged

Infrastructure

PAM Crypto Appliance

PAM Load Balancer

Delivery : On Cloud (SaaS) | On-premises | Hybrid

Services

and Support

Documentation

Solution Center

Suggestions

Training and Certification

Deployment and Consulting

PAMaturity

PAM 360º

Support Policy

senhasegura

Resources

Rich Materials

Customer Cases

Webinars Calendar

senhasegura Stickers

BLOG

CONTENT

Is your company really prepared for a cyber attack?

The Pillars of Information Security

7 signs that your company needs to improve the security of sensitive data

See more articles about cybersecurity

Technical

Information

How it works

Product Archicture

Integration

Security

High availability and contingency

Privileged Auditing (Configuration)

Privileged Change Audit

Features and

Functionalities

ITSM Integration

Behavior Analysis

Threat Analysis

Privileged Information Protection

Scan Discovery

Task Management

Session Management (PSM)

Application Identity (AAPM)

SSH Key Management

Affinity Partner

Program

About the Program

Become a Partner

MSSP Affinity Partner Program

Security Alliance Program

Academy | E-learning for Certification

Affinity

Portal

Portal dedicated only for Partners to find commercial, marketing supporting materials and certification program of senhasegura.

Access Partner Portal

Opportunity

Booking

For our Commercial Team to support your sale more effectively, request your opportunity booking here.

Opportunity Booking Request

Find a

Partner

We work together to offer a better solution for your company.

Check all senhasegura partners

About

Company

About us

Achievements

Why senhasegura

Press Release

Press Room

Events

Career

Presence in the World

Terms of Use

End User License Agreement (EULA)

Privacy and Cookie Policy

Information Security Policy

Certification at senhasegura

senhasegura

Testimonials

See Testimonials

Latest Reports

and Awards

KuppingerCole Leadership Compass Report for PAM 2023

Frost & Sullivan Customer Value Leadership Award 2022

Gartner PAM Magic Quadrant 2021 Report

KuppingerCole Leadership Compass: PAM 2021

GigaOm Radar Report 2021

Gartner PAM Magic Quadrant 2020

Gartner Critical Capabilities for PAM 2020

Information Services Group, Inc. (ISG)

KuppingerCole Leadership Compass: PAM 2020

Contact our team

Request a Demonstration

Just-in-Time Elastic Provisioning of DevOps Secrets

by senhasegura Blog Team | May 13, 2020 | BLOG

Digital transformation, now accelerated by the Covid-19 pandemic, will drive businesses like Cloud, IT Services, and Development. Against this background, new agile software-development methods, such as DevOps, have significantly changed the way companies operate, allowing an increase in speed and efficiency in software development. However, it is worth mentioning that investments in Information Security will need to be made to mitigate the associated business risks.

According to Gartner, by 2021, DevSecOps practices (i.e., the adoption of Security practices in Development and Operation processes) will be adopted by 60% of agile development teams, against 20% in 2019. Thus, in this article, we will present the DevOps scenario, the associated cybersecurity concepts, and Privileged Access Management, as well as senhasegura as a PAM solution, which helps to protect secrets in DevOps environments to ensure DevSecOps practices.

How important is a DevOps?

In times of fast deliveries and immediate results, DevOps environments have emerged to meet the need for high-quality deliveries in the shortest possible time. Therefore, through the extensive use of automation for building and testing and the integration of processes between the Development and Operations teams, it is possible to speed up product development activities. These activities include building, testing, and launching software, quickly and reliably. Nevertheless, DevOps environments are complex in terms of infrastructure and culture. As a result, many companies are not structurally prepared to implement DevOps properly. And what had been designed to bring agility and quality to the development process, if poorly implemented, can be a means for creating vulnerabilities and gaps in the cybersecurity goals. At the same time, security should not be a factor that increases development time.

As a new way of working, DevOps security issues are new too. So, clients are still learning how to solve them, and solution developers are also creating ways to solve these new problems. These problems are spread throughout the entire development process of the DevOps pipeline, from product planning and building to implementation and monitoring.

However, only 46% of IT professionals are currently mapping security risks in the early stages of development. Thus, with security as a secondary concern, DevOps teams may underestimate basic cybersecurity practices. In DevOps environments, which rely on coding, careless developers might allow leaks of confidential information, such as secrets, through APIs or poorly configured containers, without risks being perceived by administrators. 

The solution to this problem is as follows: separating sensitive secrets from the Development team. This solution does not need to consume many resources. In fact, secret management is an extension of Privileged Access Management – in some cases already implemented in the organization -, and occurs in the development pipeline.  In this context, one of the approaches used by security solution manufacturers is the provision of Just-in-time access.

How can Just-in-Time help?

The purpose of just-in-time is to allow access to applications or systems only at predetermined periods, and on-demand. Thus, through just-in-time, organizations are able to grant privileges to credentials, both personal and machine ones, in order to provide granular privileged access to an application or system, just to perform a certain task. This type of access is one of the means used to securely provide and grant access, and thus reduce the attack surface and the associated cybersecurity risks.

MT4: senhasegura is a PAM provider that focuses on reducing complexity and accelerating maturity in DevOps environments. senhasegura’s DevOps Secret Management (DSM) can help organizations increase security through the DevSecOps journey. Via this module, one can scan the development pipeline to detect sensitive data, allow the rotation of secrets without the need for code refactoring and, in this way, isolate sensitive data in production from development teams.

Thus, senhasegura is able to leverage the PAM infrastructure to provide a secret management tool, benefiting from the senhasegura platform, known by its deployment easiness and user-friendly approach. Therefore, the implementation of senhasegura allows reducing security risks and time to value in agile organizations. 

One of the use cases introduced by senhasegura is the elastic provisioning of Just-in-Time secrets – senhasegura ensures that each container application has its own secret. In this way, the application pods in Kubernetes use the integration APIs from senhasegura’s DevOps Secret Management to manage the secrets of each of the applications. Secrets are provided in senhasegura through the Just-in-Time mode, that is, only when the secret is needed. Besides, a secret is provisioned for each pod, allowing secrets to be used only by their respective pods. Also, senhasegura deprovisiones the secrets after their use, reducing the attack surface.


For an environment focused on individual actions, applying secret management effectively and worrying about who has access is critical to building this environment in a pipeline. Therefore, by increasing visibility into the functions and the access to information in the pipeline, organizations are able to reduce the risk of data leaks, which can lead to loss of revenue and trust by partners, clients, and suppliers.

To conclude, the security management context in DevOps environments is not part of the current DevOps process. Through the integration of basic privilege management protocols, organizations can ensure that security is prioritized and ensured in the development process.

← The importance of proper Digital Certificate Management Endpoint Protection through Remote Work →

$13 million growth investment drives senhasegura’s expansion in North America and the Middle East

Written by Priscilla Silva São Paulo, March 10, 2023 - senhasegura, an award-winning Privileged Access Management (PAM) solution provider that protects corporate IT environments and critical resources from cyber threats, announces a $13 million funding round from...
Read More

senhasegura wins CyberSecured 2022 award as best PAM solution in the USA

Written by Priscilla Silva SÃO PAULO, February 28 of 2023 - The 2022 edition of the CyberSecured awards, promoted by Security Today magazine, a brand of 1105 Media's Infrastructure Solutions Group, elected senhasegura as the winner in the Privileged Access Management...
Read More

How User and Entity Behavior Analytics Helps Cybersecurity

Cyberattacks are increasingly sophisticated, making traditional digital security tools insufficient to protect organizations from malicious actors. In 2015, Gartner defined a category of solutions called User and Entity Behavior Analytics (UEBA).Its big advantage is...
Read More

Best Practices for Consolidating Active Directory

This article was developed especially for you, who have questions about the best practices for consolidating Active Directory. First of all, you need to understand that directory services have the role of organizing important information for companies in a centralized...
Read More

senhasegura introduces the “Jiu-JitCISO” concept to show the power of Brazilian cybersecurity

Written by Priscilla Silva São Paulo, January 13, 2023 - "Like Jiu-Jitsu senhasegura is about self-defense. Every company must know how to protect itself and its clients". This is the aim based on the philosophy of the Japanese martial art, but made popular and...
Read More
Copyright 2023 senhasegura | All Rights Reserved | Powered by MT4 Group