BUILDING UBER'S MULTI-CLOUD SECRETS MANAGEMENT PLATFORM TO ENHANCE SECURITY

Summary from the TLDR InfoSec newsletter

Uber initially employed various secrets management practices and vaults for different teams and clouds, which it consolidated into six vaults under the purview of its Secrets team. The Secrets team created scanners to perform real-time scanning and scheduled scanning to identify secrets usage in chat apps and code, as well as built APIs for automated secrets rotation from the centralized secrets vaults. The team also developed a secrets exchange system to distribute secrets to third-party vendors.