HashiCorp Vault through HashiCorp Cloud Platform was integrated by Mindflow to enable users to automate their incident management and better protect their information system.

HashiCorp Vault Overview

HashiCorp Vault is an identity-based secret and encryption management system available on the cloud via HashiCorp Cloud Platform.

Vault validates and manages the access from authorized clients (that can be users, machines, or apps) to many secrets, including database credentials, API keys for external services, credentials for service-oriented architecture communication, and provide a platform where you can manage key rolling, secure storage, and generate and store detailed audit logs.

In the platform, you can securely store and manage access to secrets that can be various assets, from API encryption keys and passwords to certificates. Beyond the encryption services, Vault provides the necessary tools to create gated authentication and authorization methods. Using Vault’s UI, CLI, or HTTP API, access to secrets and other sensitive data can be securely stored and managed, tightly controlled (restricted), and auditable.

Integrated in Mindflow’s platform, HashiCorp Vault users can orchestrate actions such as managing a secret or performing group revocation needed as part of a containment process designed in a playbook through the platform.

Benefits

You can store arbitrary key/value secrets in Vault that encrypts them before writing them to persistent storage, so gaining access to the raw storage isn’t enough to access your secrets.

You can generate secrets on-demand for some systems, such as AWS or SQL databases.

Vault can encrypt and decrypt data without storing it, allowing security teams to define encryption parameters and developers to store encrypted data in a location without setting up their own encryption methods.

All secrets stored in Vault have a lease associated with them. At the end of this lease, and without renewals, Vault will automatically revoke that secret.

Vault can revoke not only single secrets but a tree of secrets, like secrets read by a specific user or of a particular type.