Building blocks of security lifecycle management
summary
A real breach chain reproduces: Argo CD runs a sidecar with host UID, attackers use an unauthenticated Helm server to gain cluster‑admin and exfiltrate Loki logs, S3 mounts, Docker creds and Artifactory access. A survey of 150 enterprises finds only ~33% of secrets are policy‑managed and Verizon shows web credentials are the top initial vector. Solutions shown: Radar agent to find unmanaged secrets, Vault Secrets operator for Kubernetes, and autorotating secrets that push rotations to cloud secret stores and reduce blast radius.
AI-written summary · about
chapters (12)
- 0:00Introduction to security lifecycle
- 1:38Real-world security breach examples
- 10:33Lessons from industry breaches
- 13:59Key takeaways for security teams
- 15:07HashiCorp’s security portfolio
- 18:09Finding unmanaged secrets with Radar
- 20:03Simplifying secrets management with HCP Vault
- 23:43Automatic secret rotation demo
- 26:18Kubernetes secrets with Vault
- 27:01Transparent SSH sessions with Boundary
- 27:43Certificate lifecycle automation
- 28:36Closing and product announcements
related talks
14mSecurity lifecycle management in a multicloud world
38mAdventures in Cloud Security: What DevOps Can Learn from a Security Engineer
49mEnhancing CI/CD Secrets Security: The 3Rs Approach
25mCan you keep a secret?
36mThe Insider Threat: Third-Party Applications In Your Cluster
29mSecuring Secrets in K8s Environments
29mBehind Closed Doors: Managing Passwords in a Dangerous World
22mDevSecOps - The Story of 3 Security Breaches