Secret Management

• Credentials for company email accounts such as info@..., sales@..., etc.
• Access credentials for managing all services and social profiles, e.g.:
  • Facebook account administrator
  • Access to the company Google account
  • Management of an external email server
• Access to the corporate CMS for web management, LMS with internal courses, etc.
• Dedicated system administrator accounts for SharePoint, AyMINE, etc.
• Corporate server access credentials and certificates

End-to-End Encryption

End-to-end encryption encrypts data on your device, and it remains encrypted until it reaches another end-to-end encrypted destination capable of decrypting it. At no point between the endpoints can the data be accessed.

Fake End-to-End Encryption

Many services promise end-to-end encryption, but the mechanism does not actually protect the data at all times.

Examples of fake encryption:

• There is a "backdoor" in the encryption mechanism, allowing the operator to decrypt it. Suspicions that Meta exploits this are repeatedly discussed.
• A service claims end-to-end encryption, but means that transmission between your device and the server is encrypted, and then the data is encrypted on the server. This is how protection is provided by most cloud storage providers.

Risks on Network Drives or DMS Without Encryption

If data is protected only by credentials, you have no control over who actually has access to it. Access rights can be changed temporarily to gain access to the data and then restored to their original state. Even if the change is logged, no one will ever notice without additional review. Access right changes occur regularly, making it easy for an extra change to get lost among them. And even if someone notices, it is easy to claim it was a mistake. How can that be disproved?

Network and server administrators have broad permissions in companies, but that certainly does not mean they should have access to all services. Furthermore, their accounts are the primary targets of external attacks. Therefore, a system administrator account should never have access to secrets unless strictly necessary.

Network drives can be compromised by a hacker. If credentials to other systems are stored on them, they can easily be exploited. You might not even know that the data has already been compromised.

Network drives are backed up and archived. Archives pose another risk because they are moved under the management of other administrators and can be attacked independently of the backed-up storage. Thus, each backup increases data risks.

Risks of Storing Secrets on Local Drives

Local hard drives on computers are even riskier than network drives. Network administrators (via remote management) and service technicians can gain access to these drives. Most computers end up in the hands of administrators—both internal and external—at least occasionally.

Deleting data when decommissioning a computer is not completely safe either. Although procedures and tools exist, control over how thoroughly the deletion was performed is usually minimal.

The security of local drives is generally even lower than that of network drives, partly because OS systems like Windows lack built-in isolation to prevent programs from accessing data outside their own directories.