HashiCorp Vault scans for skeletons in your code closet
(2023/10/11)
- Reference: 1697050871
- News link: https://www.theregister.co.uk/2023/10/11/secrets_and_sync_hashicorp/
- Source link:
HashiConf HashiCorp today revealed its latest front in the battle against secrets sprawl with new Vault functionality – plus a first look at the fruits of the company's BluBracket purchase.
Unsurprisingly, the announcements at the company's annual HashiConf shindig – this year in San Francisco – were heavy on the HashiCorp Cloud Platform (HCP). However, some features from HCP have made their way into the enterprise product.
HCP Vault Radar
HashiCorp bought code security startup BluBracket earlier this year, and the alpha of HCP Vault Radar is the first emission resulting from the venture.
In a nutshell, HCP Vault Radar is a cloud service to automate code scanning, including detecting, identifying, and removing secrets. The HashiCorp team has integrated the service in Git-based version control, AWS Configuration Manager, and directory structures in the HCP ecosystem.
[1]And now for something completely different: Python 3.12
[2]GitHub alienates developers by force feeding them AI recommendations
[3]From browser brat to backend boss: Will WASM win the web wars?
[4]PowerShell? More like PowerHell: Microsoft won't fix flaws in package gallery ripe for supply chain attacks
[5]This typo sparked a Microsoft Azure outage
The market for code scanning tools is crowded: GitHub, for example, will [6]scan a user's repos for anything that shouldn't be there.
HashiCorp's take goes somewhat further, with a range of categories on offer. As well as secrets, the tool will hunt out personally identifiable information (PII) and infrastructure-as-code (IAC) risks. It will also root out non-inclusive language and dependencies.
The company's vision for the tool, which won't hit beta before January 2024 with general availability following later in the year, is intended to encompass much of the developer IT estate, from Git providers, CI/CD tools, version control, and code servers down to messaging and ticketing systems.
Secrets and Sync
More here and now is the general availability of HCP Vault Secrets following a stint in beta – the SaaS product focuses primarily on secrets management – and a Vault Enterprise Secrets sync beta. The latter was a service previously only available in HCP Vault Secrets but has now turned up in Vault Enterprise 1.15.
Secrets sync is designed to permit platform teams to centralize secrets management while allowing developers to consume secrets as needed in their applications. The nature of the tool means it will happily hop across platforms – the beta release includes support for AWS, Azure, GCP, and GitHub. ®
[7]
Get our [8]Tech Resources
[1] https://www.theregister.com/2023/10/03/python_312_release/
[2] https://www.theregister.com/2023/09/13/github_alienates_customers_by_force/
[3] https://www.theregister.com/2023/09/01/web_assembly_wasm_column/
[4] https://www.theregister.com/2023/08/16/microsoft_powershell_gallery_flaws/
[5] https://www.theregister.com/2023/06/03/microsoft_azure_outage_brazil/
[6] https://docs.github.com/en/code-security/secret-scanning/about-secret-scanning
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/devops&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZScbCXFaZYedwohOt0gVZwAAABQ&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[8] https://whitepapers.theregister.com/
Unsurprisingly, the announcements at the company's annual HashiConf shindig – this year in San Francisco – were heavy on the HashiCorp Cloud Platform (HCP). However, some features from HCP have made their way into the enterprise product.
HCP Vault Radar
HashiCorp bought code security startup BluBracket earlier this year, and the alpha of HCP Vault Radar is the first emission resulting from the venture.
In a nutshell, HCP Vault Radar is a cloud service to automate code scanning, including detecting, identifying, and removing secrets. The HashiCorp team has integrated the service in Git-based version control, AWS Configuration Manager, and directory structures in the HCP ecosystem.
[1]And now for something completely different: Python 3.12
[2]GitHub alienates developers by force feeding them AI recommendations
[3]From browser brat to backend boss: Will WASM win the web wars?
[4]PowerShell? More like PowerHell: Microsoft won't fix flaws in package gallery ripe for supply chain attacks
[5]This typo sparked a Microsoft Azure outage
The market for code scanning tools is crowded: GitHub, for example, will [6]scan a user's repos for anything that shouldn't be there.
HashiCorp's take goes somewhat further, with a range of categories on offer. As well as secrets, the tool will hunt out personally identifiable information (PII) and infrastructure-as-code (IAC) risks. It will also root out non-inclusive language and dependencies.
The company's vision for the tool, which won't hit beta before January 2024 with general availability following later in the year, is intended to encompass much of the developer IT estate, from Git providers, CI/CD tools, version control, and code servers down to messaging and ticketing systems.
Secrets and Sync
More here and now is the general availability of HCP Vault Secrets following a stint in beta – the SaaS product focuses primarily on secrets management – and a Vault Enterprise Secrets sync beta. The latter was a service previously only available in HCP Vault Secrets but has now turned up in Vault Enterprise 1.15.
Secrets sync is designed to permit platform teams to centralize secrets management while allowing developers to consume secrets as needed in their applications. The nature of the tool means it will happily hop across platforms – the beta release includes support for AWS, Azure, GCP, and GitHub. ®
[7]
Get our [8]Tech Resources
[1] https://www.theregister.com/2023/10/03/python_312_release/
[2] https://www.theregister.com/2023/09/13/github_alienates_customers_by_force/
[3] https://www.theregister.com/2023/09/01/web_assembly_wasm_column/
[4] https://www.theregister.com/2023/08/16/microsoft_powershell_gallery_flaws/
[5] https://www.theregister.com/2023/06/03/microsoft_azure_outage_brazil/
[6] https://docs.github.com/en/code-security/secret-scanning/about-secret-scanning
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/devops&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZScbCXFaZYedwohOt0gVZwAAABQ&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[8] https://whitepapers.theregister.com/