Secret rotation
Every secret rotates within its maximum age, and a leaked secret is revoked within one hour of detection.
Satisfies
| Criterion | Text |
|---|---|
| SOC2 CC6.1 | The entity implements logical access security software, infrastructure and architectures over protected information assets. |
| ISO27001 A.5.17 | The allocation and management of authentication information is controlled. |
Implemented by
Test
| Step | Rule |
|---|---|
| Kind | Detective: it finds the failure after it happens. |
| Select | Every secret held in any namespace, on each day of the report period. |
| Assert | No secret exceeds its maximum age, and every detected leak has a revocation Event within one hour. |
Owner
Security Engineer, Engineering Team.
Example
A payment key for a print-on-demand shop appears in a public paste. Leaked-key scanning revokes it 12 minutes after detection and issues a new one.