GRC Keamanan Siber 13 butir
Secrets Management & Credential Hygiene Audit
Daftar periksa ini dalam bahasa Inggris.
Audits how application secrets, API keys, and credentials are stored, rotated, and prevented from leaking into code and pipelines.
CIS v8NIST 800-53OWASP
PDF atau Word gratis · masukkan email Anda untuk mengunduh.
Secret Storage
- Are secrets stored in a dedicated secrets manager or vault rather than in code? *
- Are secrets encrypted at rest with access restricted by policy? *
- Are hardcoded secrets and credentials prohibited in source repositories? *
- Are configuration files and environment variables free of plaintext secrets?
Rotation & Lifecycle
- Are secrets rotated on a defined schedule or automatically? *
- Are secrets rotated promptly after suspected exposure or personnel changes? *
- Are short-lived, dynamically generated credentials used where supported?
Detection & Prevention
- Is automated secret scanning enabled on repositories and commits? *
- Are pre-commit hooks or pipeline gates used to block secret commits? *
- Is there a defined process to revoke and remediate leaked secrets? *
Access & Auditing
- Is access to secrets granted on a least-privilege, per-application basis? *
- Are secret access events logged and monitored? *
- Are secrets injected at runtime rather than baked into build artifacts? *
Unduh daftar periksa Secrets Management & Credential Hygiene Audit lengkap
Dapatkan secara gratis sebagai PDF yang rapi dan siap cetak atau dokumen Word yang dapat diedit.