Latest / DevQuestions with Tim Corey / 326. Where Do Secrets Belong In My Application?

Transcript

326. Where Do Secrets Belong In My Application? · DevQuestions with Tim Corey

• 0:04
  SPEAKER_00: Most applications have to deal with secret information.
• 0:08
  SPEAKER_00: From API keys to passwords to connection strings, connecting to sensitive resources involves secrets.
• 0:14
  SPEAKER_00: So where do you put them?
• 0:16
  SPEAKER_00: How do you ensure they are staying secret?
• 0:18
  SPEAKER_00: Those answers change based upon a lot of factors, including development versus production, and whether or not you're using an AI to help you in development.
• 0:28
  SPEAKER_00: So let's talk about it in today's episode of DevQuestions.
• 0:41
  SPEAKER_00: Software development is more than just writing code.
• 0:44
  SPEAKER_00: So let's talk about the rest of it.
• 0:45
  SPEAKER_00: Specifically, let's talk about where to store your secrets as a developer.
• 0:50
  SPEAKER_00: And let's start off by saying that this answer has changed a bit in light of AI agents.
• 0:56
  SPEAKER_00: So what was recommended practice isn't necessarily the right call anymore.
• 1:01
  SPEAKER_00: Also, I'm going to be addressing this as a.NET developer.
• 1:04
  SPEAKER_00: If you are a.NET developer, some of this might not apply.
• 1:07
  SPEAKER_00: However, most of it will.
• 1:09
  SPEAKER_00: And the principles will be similar for your language.
• 1:11
  SPEAKER_00: I will be talking about front-end frameworks like React as well.
• 1:15
  SPEAKER_00: So that will directly apply.
• 1:17
  SPEAKER_00: Let's start with a big one.
• 1:19
  SPEAKER_00: Developers should not have access to any production resources.
• 1:24
  SPEAKER_00: Now, there is an exception here for if you're on a very small team where you're also the production deployment person.
• 1:32
  SPEAKER_00: But even then, there needs to be some separation.
• 1:36
  SPEAKER_00: So the information you have, whether you are a small team as your job too, or whether it's somebody else's job, the information about the secrets, about the connection strings, and other things should be stored in something like Azure Key Vault.
• 1:51
  SPEAKER_00: And the devs should not have access to it or to the production servers.
• 1:58
  SPEAKER_00: This is especially true if AI has access to developer machines.
• 2:06
  SPEAKER_00: AI looks for credentials.
• 2:08
  SPEAKER_00: It's unfortunately one of the things that people don't realize AI does.
• 2:14
  SPEAKER_00: When you give an AI permission to look at your hard drive, it doesn't always stay where it's supposed to stay.
• 2:21
  SPEAKER_00: Sometimes it wanders a bit.
• 2:23
  SPEAKER_00: And one of the things that we have seen over and over is that an AI will look to elevate its own permissions to solve the problem of not having access to something.
• 2:37
  SPEAKER_00: And it has more than one once looked and found those credentials and then treated that like it's a development resource and done some pretty horrific things in production.
• 2:49
  SPEAKER_00: So we need to be very careful to separate out our sensitive data from our AIs, but even from developers, they should not have access to production.
• 3:02
  SPEAKER_00: And I know a lot of developers say, no, I definitely should.
• 3:05
  SPEAKER_00: How else could I debug it?
• 3:06
  SPEAKER_00: How else could I?
• 3:08
  SPEAKER_00: There are ways, as long as you're focused on being secure.
• 3:13
  SPEAKER_00: If you're focused on being fast and on just quote unquote getting the job done and not worried about security, sure.
• 3:23
  SPEAKER_00: Have access to the keys for everything and then just be safe, right?
• 3:28
  SPEAKER_00: But that's not a good practice.
• 3:31
  SPEAKER_00: A good practice is to have clear separation and automated systems that take you the last steps.
• 3:38
  SPEAKER_00: Because part of your process should be a good CI CD process that takes your code from one location to another in automated manner.
• 3:49
  SPEAKER_00: So you're testing how it's going to work when you deploy.
• 3:53
  SPEAKER_00: That way you are sure this is going to work and you're not going to have surprises when you hit production.
• 4:00
  SPEAKER_00: This makes your deployment to production faster, it makes it cleaner, it makes it less likely to have to be rolled back and more.
• 4:07
  SPEAKER_00: So that whole process should be automated anyway.
• 4:11
  SPEAKER_00: So developers shouldn't be touching production directly for deployments.
• 4:17
  SPEAKER_00: So the other part of that is well, developers need to have access in order to debug stuff.
• 4:22
  SPEAKER_00: Well, if you are properly backing up your production systems, especially your databases, and then cleaning that data and putting it into development as a development database, you often don't need to even do that because the development data is just hours different than production.
• 4:39
  SPEAKER_00: So all of a sudden, now you have all the data you need while being secure.
• 4:44
  SPEAKER_00: Things like email addresses have been sanitized, things like person-identifiable information has been changed so that you're not giving developers access to sensitive information, but at the same time, they have all the information they need for testing.
• 4:59
  SPEAKER_00: And your environment should be very, very similar between production and development so that you can accurately test on things.
• 5:07
  SPEAKER_00: So, yes, I recommend that developers not have access to any production resources, especially not just because, but especially if they use AI.
• 5:21
  SPEAKER_00: Because too often AI will use those credentials or ingest those credentials, which means they all need to be rotated.
• 5:29
  SPEAKER_00: Okay, so what do you do during development?
• 5:34
  SPEAKER_00: Well, if you're a.NET developer, store your secrets in the user secrets JSON file.
• 5:41
  SPEAKER_00: If you don't know what that is, I've got videos on my channel.
• 5:43
  SPEAKER_00: I have a whole course dedicated to app settings, including user secrets.
• 5:48
  SPEAKER_00: Um, these are for things where it's gonna be local.
• 5:52
  SPEAKER_00: So you're working on a local database, you're working on a local email server equivalent where it's just you know showing that yes, an email went out or something like that, but it's not actually sending emails.
• 6:04
  SPEAKER_00: Um, all these different things, they're local and you have your own local settings.
• 6:08
  SPEAKER_00: If you put those in user secrets, they don't go into your source control, they don't disrupt the other users on the team and what their local secrets are, and yet you can all use your own local secrets to have your own local setup.
• 6:23
  SPEAKER_00: This is the way you do it.
• 6:25
  SPEAKER_00: So that's kind of step one.
• 6:26
  SPEAKER_00: Have a place for local secrets.
• 6:28
  SPEAKER_00: Again,.NET developers, we have it easy.
• 6:30
  SPEAKER_00: We just use user secrets.
• 6:33
  SPEAKER_00: Now, with that, do not give AI access to your hard drive.
• 6:38
  SPEAKER_00: Which you probably say, uh, that's too late for that.
• 6:40
  SPEAKER_00: I've already done that.
• 6:42
  SPEAKER_00: Change that.
• 6:43
  SPEAKER_00: Don't do that.
• 6:44
  SPEAKER_00: Instead, run it in a container.
• 6:47
  SPEAKER_00: Give it full access if you want to that container, but not to your actual hard drive.
• 6:53
  SPEAKER_00: Otherwise, there are too many things that AI can do to compromise you.
• 6:58
  SPEAKER_00: It can read through your entire drive and figure out what secrets might be there.
• 7:06
  SPEAKER_00: It can look at different your browser headless and look at all the local storage and session storage in your browser for any secrets that may be there.
• 7:16
  SPEAKER_00: So it can do a lot of things that you really don't want to have at have it have access to.
• 7:22
  SPEAKER_00: And all of a sudden, your AI might have access to things that you never expected it to.
• 7:27
  SPEAKER_00: So make sure you isolate your AI from your actual development machine.
• 7:32
  SPEAKER_00: Run it in a container.
• 7:33
  SPEAKER_00: It's absolutely possible.
• 7:35
  SPEAKER_00: It's not that hard.
• 7:36
  SPEAKER_00: You can do this.
• 7:38
  SPEAKER_00: Make sure you separate it from your development machine.
• 7:40
  SPEAKER_00: Again, because when you store your user secrets in that secrets.json, well, your AI can go and read those.
• 7:48
  SPEAKER_00: And those should not be secret.
• 7:51
  SPEAKER_00: Okay?
• 7:51
  SPEAKER_00: Those should not be a big deal.
• 7:54
  SPEAKER_00: They should be something that can be given away.
• 7:57
  SPEAKER_00: They because you should be using like, you know, SA for both a username and password for a SQL database.
• 8:03
  SPEAKER_00: And you might, you know, using a connection string that has no credentials but lets you log into a local database.
• 8:09
  SPEAKER_00: These things should not be secrets.
• 8:12
  SPEAKER_00: But you still don't want to have access, give AI access to things it shouldn't have access to, especially if you're a person who reuses credentials too much.
• 8:21
  SPEAKER_00: Don't do that.
• 8:23
  SPEAKER_00: And that kind of leads us into the next point.
• 8:25
  SPEAKER_00: Do not access production resources locally.
• 8:29
  SPEAKER_00: This is one that we all violate at some point because it's just easier.
• 8:35
  SPEAKER_00: And don't do this, don't give into this.
• 8:38
  SPEAKER_00: But this is one where, you know what, I'm gonna put the production connection string in my app and run it locally just to see what's happening.
• 8:45
  SPEAKER_00: But I can debug easier if I have Visual Studio open in debug mode, but have the production connection string.
• 8:51
  SPEAKER_00: Don't do that.
• 8:53
  SPEAKER_00: Because then what happens is you've given access to potentially an AI to scan that.
• 8:58
  SPEAKER_00: If you have, if you're using Visual Studio, you might have copilot running and that could potentially see your connection strings.
• 9:04
  SPEAKER_00: Don't do that.
• 9:05
  SPEAKER_00: You might accidentally put it into source control, and that's a big issue.
• 9:10
  SPEAKER_00: Um so don't do that.
• 9:12
  SPEAKER_00: Don't use production resources locally.
• 9:15
  SPEAKER_00: It's just too easy to let those slip out in some way.
• 9:20
  SPEAKER_00: Next up, do not give AI full access to GitHub.
• 9:26
  SPEAKER_00: Again, I've told you put AI in a container and run a container.
• 9:30
  SPEAKER_00: Well, give it a personal access token.
• 9:33
  SPEAKER_00: Okay.
• 9:34
  SPEAKER_00: Don't give it a full token, give it access to just what it needs in GitHub.
• 9:39
  SPEAKER_00: Because again, if you give it full access, if you get your access to GitHub, if it's using your access on your machine, well, you have access to go look at user secrets potentially or change user secrets.
• 9:52
  SPEAKER_00: That's a problem.
• 9:53
  SPEAKER_00: Like there are GitHub secrets that it could access or use in a way that you don't want it to use.
• 9:59
  SPEAKER_00: Don't do that.
• 10:00
  SPEAKER_00: Don't give it full access to GitHub.
• 10:03
  SPEAKER_00: Use a personal access token and limit that, restrict that.
• 10:07
  SPEAKER_00: Next up, use containers for all local development resources as much as possible.
• 10:14
  SPEAKER_00: So for instance, I used to install SQL Server on my development machine.
• 10:18
  SPEAKER_00: I use it so often, I'm like, well, this is what you do.
• 10:21
  SPEAKER_00: You install it locally because I don't want to work across a network somehow.
• 10:24
  SPEAKER_00: And yes, you can use local DB or something like that, but it was just easy to install SQL Server.
• 10:30
  SPEAKER_00: I haven't done that in years because I use containers.
• 10:33
  SPEAKER_00: I can spin up a SQL Server in minutes and have it running.
• 10:37
  SPEAKER_00: I have a SQL Server, I have a MongoDB server, I have a RavenDB server, I have uh Azure, I have a whole bunch of different servers running when I need them to.
• 10:47
  SPEAKER_00: And when I don't need them to, I shut them down.
• 10:50
  SPEAKER_00: This isolates them.
• 10:51
  SPEAKER_00: It also makes them very easy to dispose and restart.
• 10:55
  SPEAKER_00: This is something you want to do.
• 10:57
  SPEAKER_00: Get used to using containers, use them over and over again, but then throw them away when you don't need them anymore and start over.
• 11:05
  SPEAKER_00: Containers are amazing.
• 11:07
  SPEAKER_00: They make your system run faster, but you're not running SQL Server in the background, taking up lots of memory for no reason.
• 11:15
  SPEAKER_00: So it makes your system faster, but it also makes it easier to reset things and start over.
• 11:20
  SPEAKER_00: So as a developer, you shouldn't be directly accessing production systems or resources.
• 11:27
  SPEAKER_00: Keep that separation clear.
• 11:28
  SPEAKER_00: Otherwise, a mistake locally can damage or destroy your production systems.
• 11:33
  SPEAKER_00: Instead, use local resources with throwaway credentials for local development.
• 11:37
  SPEAKER_00: Even then, keep your AI tools and agents away from your development machine itself.
• 11:42
  SPEAKER_00: Keep them segmented into containers or virtual machines so they cannot find elevated permissions in a credential hunt.
• 11:51
  SPEAKER_00: They're gonna try at some point, just protect yourself.
• 11:55
  SPEAKER_00: All right.
• 11:55
  SPEAKER_00: Thanks for listening.
• 11:56
  SPEAKER_00: As always, I am Tim Corey.