The Nightmare for Attackers: An Infrastructure without Secrets
summary
Claims a practicable path to eliminate long‑term secrets and cuts credential-based attack risk by 60% reduction in credential-based attacks using concrete combos: SSO + OIDC + Cloud IAM for repo and workload identities, Vault for dynamic DB credentials, and tooling like oauth2-proxy and bastion paired with Vault for non‑SSO apps. Shows CI configured to mint short‑lived AWS creds via OIDC and a demo where Vault agent creates per‑pod dynamic DB credentials, with some demo glitches but the Vault patterns and rotation approaches functioning end to end.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:12Zero credential infrastructure
- 2:37Traditional secret problems
- 5:28Paradigm shift to zero credentials
- 6:30Benefits of zero credentials
- 10:08Where credentials are stored
- 11:55Reduce long-term credentials
- 12:40Developer secrets and SSO
- 16:19CICD secrets and code scanning
- 19:53CICD secrets with OIDC trust
- 27:53Workload secrets challenges
- 29:43Kubernetes and Vault setups
- 32:57Vault agent demo
- 43:00Final recommendations
related talks
45mAttackers' Nightmare: An Infrastructure Without Secrets
24mDeveloper-First Application Security and DevSecOps
38mKeeping Secrets - A Practical Approach to Managing Credentials
25mCan you keep a secret?
25mIntegrating Vault with CI/CD pipelines: Best practices and pitfalls
28mSecret Management with Hashicorp´s Vault
30mSimplifying Secrets Management in the Public Cloud
29mBehind Closed Doors: Managing Passwords in a Dangerous World