KEEPING SECRETS OUT OF LOGS

Summary from the TLDR InfoSec newsletter

Secrets often end up in logs from a variety of sources, such as forgotten debugging lines, excessive error logging, and telemetry. Some fixes include architecting to reduce logging sinks, using domain primitives to abstract secrets, using read-once objects, using log preprocessors, adding unit tests, and implementing taint tracking. To prepare for a logging overhaul, teams should first lay the foundations of the initiative, understand the data flow, protect data at choke points, apply defense-in-depth, and plan for response and recovery in the event of leaked secrets.