Regularly Rotate Encryption Keys and Credentials

Regularly rotating encryption keys, passwords, and certificates reduces the risk of old, compromised credentials being used for unauthorized access. Attackers often exploit stolen or leaked credentials, so periodic rotation helps:

✅ Mitigate the impact of credential leaks by ensuring old credentials become invalid.
✅ Reduce exposure to insider threats by revoking unnecessary access.
✅ Ensure compliance with security best practices (e.g., PCI-DSS, HIPAA, ISO 27001).

How to Implement Key and Credential Rotation

1. Use a Credential Management System (CMS)

Using a secure vault to store and manage credentials helps automate key rotation.

✅ AWS KMS (Key Management Service) for AWS resources

• Automatically rotates encryption keys every 12 months.

• Configure key policies to enforce periodic key expiration.

• Example command to create a new KMS key:

  aws kms create-key --description "Rotated Key" --key-usage ENCRYPT_DECRYPT
  

✅ HashiCorp Vault → Securely manage SSH keys, API tokens, and certificates.
✅ GCP Cloud KMS → Rotate Google Cloud encryption keys automatically.

2. Rotate SSH Keys Regularly

1. Generate a new SSH key pair (RSA 4096-bit):

   ssh-keygen -t rsa -b 4096 -f ~/.ssh/new_id_rsa
   

2. Copy the new public key to the remote server:

   ssh-copy-id -i ~/.ssh/new_id_rsa.pub username@server_ip
   

3. Update SSH client config to use the new key:

   nano ~/.ssh/config
   

   Host server_ip
       IdentityFile ~/.ssh/new_id_rsa
   

4. Remove the old SSH key from the server:

   ssh username@server_ip "rm -f ~/.ssh/old_key.pub"
   

3. Rotate API Keys and Database Credentials

Many APIs and cloud services support key rotation.
✅ For AWS IAM keys:

aws iam create-access-key --user-name myuser
aws iam delete-access-key --access-key-id OLD_KEY_ID --user-name myuser

✅ For GitHub tokens:

• Navigate to GitHub → Developer Settings → Personal Access Tokens

• Generate a new API token, then delete the old one.
  ✅ For MySQL database passwords:

ALTER USER 'dbuser'@'localhost' IDENTIFIED BY 'new_secure_password';
FLUSH PRIVILEGES;

4. Automate Credential Expiration and Rotation

• Set password expiration policies in Linux:

  sudo chage -M 90 -W 10 username
  

  (Forces password rotation every 90 days, with a 10-day warning.)

• Use Ansible or Terraform to automate key rotation in cloud environments.

Best Practices for Credential Rotation

✅ Use MFA (Multi-Factor Authentication) to protect against stolen credentials.
✅ Enforce strong passwords and use passphrase-protected SSH keys.
✅ Store rotated credentials in a secure vault (e.g., AWS Secrets Manager, HashiCorp Vault).
✅ Monitor logs (/var/log/auth.log) for unauthorized access attempts.

By regularly rotating encryption keys and credentials, you reduce security risks, prevent unauthorized access, and maintain a strong security posture.