Get your secrets into one central tool or platform. Some might see it as counterintuitive to have one place where attackers know they can find your secrets, but it’s actually much safer to harden one cluster or a series of redundant clusters instead of having them stored in several different places with varying styles of management.
A surprising number of organizations don’t even have a central secrets management plan. Some teams might be using a secrets manager, or rolling their own, but others might have secrets sitting in version control systems like GitHub. They might have them in Excel spreadsheets or even a Post-it note under their keyboard. While most of us know those are not good places to keep secrets, there are plenty of junior developers or other engineers with low security knowledge that are leaving secrets like AWS keys in plaintext and publishing them on public or private repositories — and attackers can often find them in both.
