Long Live Short Lived Credentials - Auto-rotating Secrets At Scale
summary
Auto-rotate credentials by putting everything into a single secret manager, writing rotation scripts (AWS rotation Lambdas, Vault/Key Vault/Doppler integrations), and testing swaps and cleanup; a field scan finds ~10–12.8 million hardcoded secrets yearly and 90% remained valid five days later, so rotation matters. A community toolchain (Brimstone plus CyberArk/Spiffe/Spire examples) proves automatic rotation is doable at scale though it adds failure points; start greenfield, protect crown jewels, then sweep legacy. gather all secrets into one manager
AI-written summary · about
chapters (20)
- 0:00Introduction and welcome
- 1:04Credentials breach at Cloudflare
- 2:30Credentials in attack frameworks
- 3:54Hardcoded secrets on GitHub
- 5:20Why secrets aren't rotated
- 6:46History of credential security
- 8:07Current credential challenges
- 9:11Secret management basics
- 10:14Start small in security
- 11:17Ownership and maturity
- 12:20Finding existing secrets
- 16:52Greenfield and legacy secrets
- 17:54Zombie secrets problem
- 19:00Finding hardcoded credentials
- 20:04Setting auto rotation policies
- 21:47Multi-cloud rotation challenges
- 23:50Workload identity alternatives
- 25:38SPIFFY and SPIRE frameworks
- 26:40Summary and next steps
- 27:45Q&A session
related talks
26mRefactoring Applications for Dynamic Secrets
29mHow to get dynamic with secrets management
35mAutomate Secret Rotation in Kubernetes, Then Get Out of the Way!
44mSecrets at Scale: Managing Cloud Credentials with PowerShell Automation
45mAttackers' Nightmare: An Infrastructure Without Secrets
38mSecrets Management - Falling into the Pit of Success
29mManaging Secrets in Your Cloud Environment
22mSecure your secrets with automation