Introduction

Why use HashiCorp Validated Designs?

HashiCorp introduced the Validated Designs program to give customers access to a set of guidance based on our experience working with customers to deploy our solutions. Aligning to the provided recommendations gives you a fast track to a production ready service, a standard pattern for our support engineers to best support you, and help you serve your customers including application team developers with optimized workflows.

HVDs and HashiCorp Vault adoption maturity stages

HashiCorp Validated Designs provide prescriptive guidance curated from our experience with supporting numerous customer journeys using Vault Enterprise.

HashiCorp Vault Maturity Stages and Use Cases

Adopt: In the Adopt phase, the emphasis is on customers who are just starting their journey to improve their security posture by reducing secret sprawl and centralizing secrets management. In this phase customers are establishing the foundation of creating a platform based approach to centrally secure and manage secrets for various development and app teams.
Standardize: Customers in the Standardize phase, having successfully completed the Adopt phase, are seeking to expand the availability of the secrets management platform to accommodate a wider and complex range of develop team use cases. They have experienced the benefits of Vault's secure secret management for static secrets and are now ready to leverage more secure credentials such as dynamic credentials. These customers aim to centralize secrets, automate workflows, and enforce access controls. Integration into development pipelines is vital as they strive to eliminate inconsistencies and reduce security risks.
Scale: For customers in the Scale phase, who have progressed through the Adopt and Standardize phases, and gained experience in implementing security practices with Vault, their focus is on maximizing Vault's potential. Deploying across regions and clouds, ensuring high availability, performance optimization, and disaster recovery readiness are paramount. These customers require advanced features like dynamic data masking and improved resilience (performance replication) to meet rigorous security and compliance requirements.

Prerequisites

HashiCorp recommends the following prerequisites before implementing the Vault Operating Guide for Adoption:

• Review Cloud Operating Model(opens in new tab).
• Attend Vault workshop or Vault academy training.

If you are using Vault Enterprise (self-managed/self-hosted Vault), this guide assumes that you have reviewed and/or implemented the following documents:

• Vault Solution Design Guide

HashiCorp recommends using Terraform to provision and configure Vault. For guidance on using Terraform, please refer to the Terraform HVD(opens in new tab).

Language and definitions

While this guide intentionally uses technology-agnostic language, there are some terms that do not translate seamlessly between providers. This document uses the following terms.

HVD document structure

This document covers the Adopt maturity phase of operating Vault and includes the following sections.

HashiCorp Validated Design Adopt stage document structure

Objectives

Business objectives are high-level goals that organizations strive toward to achieve strategic impact, encompassing areas like customer satisfaction and revenue growth. Functional objectives, in contrast, outline detailed goals related to system features and capabilities, specifying the what and how aspects of a project. While business objectives inform the overarching direction, functional objectives concentrate on specific tasks necessary to fulfill those broader goals.

The fundamental business and functional objectives listed below are common to organizations seeking a mature solution for secrets management, and all should be realized by implementing the recommendations detailed in this guide.

Business objectives

1. Enhance security: Ensure asset, resource, and data security by centralizing and managing access to sensitive information, reducing the risk of breaches and unauthorized access.
2. Regulatory compliance: Achieve compliance with industry regulations and standards by implementing robust access controls, encryption, and audit trails for sensitive data.
   1. ISO/IEC 27001: Part of the ISO/IEC 27000 family of standards, ISO/IEC 27001 provides best practice recommendations on information security management, risk management, and adequate control mechanisms.
   2. NIST SP 800: This is a guideline from the National Institute of Standards and Technology on Digital Identity Guidelines, which covers identity proofing, authentication, and lifecycle management.
   3. PCI DSS (Payment Card Industry Data Security Standard): This standard mandates protection for cardholder data, which includes strong access controls and encryption measures.
   4. FIPS 140-2 (Federal Information Processing Standards): This is a U.S. Government standard that defines security requirements for cryptographic modules, including those that manage, process, and store cryptographic keys.
   5. SOC 2 (Service Organization Control 2): Focuses on management of customer data and requires service providers to follow strict guidelines related to security, availability, processing integrity, confidentiality, and privacy.
   6. CIS (Center for Internet Security) Critical Security Controls: These controls provide best practices for securing IT systems and data. Some controls specifically relate to account management, access controls, and data protection.
   7. OWASP (Open Web Application Security Project): While not a compliance standard, OWASP provides a list of top security risks, some of which directly relate to the management and protection of credentials and secrets.
   8. NERC CIP (North American Electric Reliability Corporation Critical Infrastructure Protection): These standards are specifically for the reliability of the bulk power system in North America, and they include requirements for access controls and managing credentials.
   9. FedRAMP (Federal Risk and Authorization Management Program): This U.S. Government-wide program standardizes security assessment and authorization for cloud products and services. It includes guidelines on managing and securing credentials and secrets.
   10. Sarbanes-Oxley Act (SOX): This U.S. legislation has implications for IT and data controls, ensuring that financial data is accurate and protected against fraud. Proper management and security of credentials are an integral part of this.
3. Operational efficiency: Streamline the management of secrets, credentials, and encryption keys, reducing administrative overhead and minimizing the potential for human error.
4. Risk mitigation: Proactively mitigate security risks associated with managing sensitive information, protecting the organization's reputation and minimizing potential financial losses.
5. Data governance: Establish consistent policies and controls for data access, enhancing accountability and ensuring that data is used and accessed appropriately.

Functional objectives

1. Centralized secrets management: Establish a unified repository for managing secrets, automating/simplifying the process of secret rotation, access, and lifecycle management.
2. Identity-based authentication (AuthN) and access authorization (AuthZ): Implement identity federation and provide fine-grained access controls tied to user identities and roles, ensuring proper authorization and reducing security risks.
3. Encryption as a service: Provide a consistent method for encrypting data at rest and in transit, enhancing data security across the organization.
4. Audit trails and logging: Generate comprehensive audit logs to track who accessed which data and when, aiding in compliance, troubleshooting, and security investigations.
5. High availability: Design a reliable architecture to minimize downtime and ensure system availability, even during hardware failures or maintenance.

Sample project plan

The table itemizes the outcomes of the HVDs to provide project managers with data they can incorporate into their project plans. You can simultaneously execute many of the activities in the following table. Your HashiCorp account team serves as a valuable resource and consulting partner, possessing the experience necessary to provide guidance. They can help you customize this plan to suit your specific and unique requirements.

HashiCorp Validated Design (HVD) adopt stage deliverables