Keep an inventory of every secret, its owner and where it is used

During an incident, the slowest part is often working out what a leaked key is for, who owns it and what breaks when you revoke it. OWASP recommends documentation that lets you find and understand each secret quickly.

For each secret, record:

• the service it belongs to
• the owner
• where it is stored
• which apps use it
• when it was last rotated
• how to rotate it

You do not need a separate tool for this. A secrets manager with descriptions and tags can be the inventory, as long as the fields are filled in when a secret is created rather than months later.

The inventory pays off well beyond incidents: it drives offboarding (which secrets did this person see?), rotation schedules and clean-up of keys nobody uses any more.

If you cannot answer "what uses this key?" in under a minute, the inventory needs work.