Skip to main content
Snyk Blog

In this article

Rotate Azure Repos SSH keys and personal access tokens

Written by
Headshot of Simon Maple

Simon Maple

Edward Thompson

Azure Blog

May 6, 2019

0 mins read

This post highlights best practice #8 — rotating SSH keys and personal access tokens — from our series of 8 security best practices for Azure Repos.

Rotate Azure Repos SSH keys and personal access tokens

Azure Repos access is typically done using SSH keys or personal access tokens (in lieu of a password). But what happens if those tokens are stolen and you didn’t know? Be sure to refresh your keys and tokens periodically, mitigating any damage caused by keys that leaked out.

Continue reading the list of 8 Azure Repos security best practices:

  1. Never store credentials as code/config in Azure Repos

  2. Remove sensitive data in your files and Azure Repos history

  3. Tightly control access

  4. Add a SECURITY.md file

  5. Use Personal Access Tokens

  6. Provide granular permissions and groups for users

  7. Add security testing to Pull Requests

  8. Rotate SSH keys and personal access tokens

If you haven’t done so yet, make sure you download this cheat sheet now and pin it up, so your future decisions are secure decisions.

Cheat sheet titled “8 Azure Repos security best practices,” with guidance on credentials, access control, security testing, and SSH keys.

Posted in:
IaC Security

Read more

Blog

JPMorgan Just Published a Cyber To-Do List and Snyk Covers 8 of the 10 Items. How do you stack up?

JPMorganChase published a 10-point cyber resilience checklist. See how Snyk covers 8 of the 10 actions and where it fits in your security stack.

feature datacenters black
Blog

How Snyk Helps Federal Agencies Prepare for the Genesis Mission Era of AI-Driven Science

Snyk helps Federal Agencies secure software for the White House's Genesis Mission, accelerating AI-driven science. Implement Secure by Design for the supply chain, cloud, and pipelines.

feature red team blue team
Blog

Ensuring comprehensive security testing in DevOps pipelines

Learn how to integrate comprehensive security testing into DevOps pipelines to protect your entire software development lifecycle.