Secret cheat sheet: added segmentation scheme

[sergiomarotco]

Adding segmentation scheme for Secret Management System.

[sergiomarotco]

@jmanico hi! 😅

[sergiomarotco]

@kwwall need approval

[kwwall]

My only comment is I think that the Middleware component is optional. There are lots of examples of where some front-end application server is using a back end key service like HashiCorp Vault or AWS KMS to retrieve something like a DB password and there is no middleware service layer at all. I would advise as either adding some explanation around that or minimally denote it as an optional layer. Otherwise, LGTM.

[sergiomarotco]

My only comment is I think that the Middleware component is optional. There are lots of examples of where some front-end application server is using a back end key service like HashiCorp Vault or AWS KMS to retrieve something like a DB password and there is no middleware service layer at all. I would advise as either adding some explanation around that or minimally denote it as an optional layer. Otherwise, LGTM.

We should publish best practices, right?
Using HashiCorp Vault as an example:

• FRONTWARE - NginX/Apache or API Management/Security software for balancing for first
• MIDDLEWARE - Vault server;
• BACKEND - Consul Server.

[sergiomarotco]

@szh

[szh]

I've held off on reviewing this because my opinion is that it needs more explanation. We should assume that a reader of the secrets management cheat sheet is an app developer who has limited understanding of network segmentation. I feel that this text is a bit too advanced for such a reader, and the diagram needs more explanation.

[kwwall]

We should publish best practices, right? Using HashiCorp Vault as an example:

• FRONTWARE - NginX/Apache or API Management/Security software for balancing for first
• MIDDLEWARE - Vault server;
• BACKEND - Consul Server.

Well, except in that case, HashiCorp Consul is the component that's optional. That's especially true in lower risk and/or smaller operations. I've seen plenty of places where Vault is used alone, without Consul. Also, "best practices" generally implies more than simply choosing the most secure solution. It may not even be that the "most secure" solution is a "best practice" if a basic working assumption is "assume breach" as adding Consul expands the potential attack service and likely increases the operational security costs substantially. Cost-benefit exercises is one side of the risk analysis that you have to do to truly know if what you are intending to deploy is the best solution. (If you can't tell, I'm one of those annoying people who don't believe that "best practices" is a one-size-fits-all solution.)