47. A cybersecurity analyst is reviewing static application security testing scan results and notices a finding for hard-coded credentials. Which of the following should the analyst recommend to the application team to resolve this concern?
Answer: D
Integrate secrets management.
Integrating secrets management is the most effective recommendation for addressing hard-coded credentials as it provides a secure method for storing and accessing sensitive information, thereby reducing the risk of exposure.
A) Implement a privileged access management solution.
While implementing a privileged access management solution can enhance security by controlling access to sensitive systems, it does not directly address the issue of hard-coded credentials within the application. This option may help manage privileges but does not eliminate the risk associated with embedded credentials in the code.
B) Enable single sign-on.
Enabling single sign-on (SSO) can improve user experience and security by allowing users to authenticate once for multiple applications. However, this option does not resolve the issue of hard-coded credentials in the application's codebase, making it an ineffective solution in this context.
C) Obfuscate application programming interface keys.
Obfuscating API keys can provide a layer of protection against casual inspection, but it does not fully secure hard-coded credentials. Attackers with sufficient access can still uncover obfuscated values, making this option inadequate for effectively managing credential security.
D) Integrate secrets management.
Integrating secrets management is the best approach to resolve the concern of hard-coded credentials. This method allows for the secure storage and retrieval of sensitive information such as passwords and API keys, ensuring that they are not hard-coded into the application and significantly reducing the risk of credential exposure.
Conclusion
The recommendation to integrate secrets management directly addresses the vulnerability of hard-coded credentials, providing a secure and efficient way to manage sensitive information. In contrast, the other options either fail to mitigate the risk effectively or do not relate directly to the problem at hand, underscoring the necessity of proper secrets management in application security.