Runtime Protection for Vault & Consul
summary
Shows a concrete runtime: Vault runs inside an Intel SGX enclave using a wrapper runtime that loads the existing Vault binary unchanged, seals TLS keys and config files to hardware, and performs automated unseal. A proof of concept runs a crackvault memory scan that recovers the master key on a normal host but fails against the enclave because memory and sealed files are inaccessible even to root. Demo works with Vault OSS and Enterprise.
AI-written summary · about
chapters (10)
- 0:00Introduction to runtime protection
- 3:36Security concerns with Vault & Consul
- 7:36Threat model for Vault & Consul
- 13:18Ideal runtime isolation solution
- 15:02Secure enclaves and SGX
- 17:13Demo: Memory protection with SGX
- 19:24Protecting unseal process and keys
- 21:54Application identity and TLS keys
- 24:02Demo: Securing Vault configuration
- 32:26Summary and Q&A
related talks
51mIntroduction to Vault
31mBuilding a Repeatable and Hardened Vault POC
44mSecret Management with Hashicorp's Vault
45mSecure Together: Consul + Vault
42mZero Trust security with HashiCorp Vault and AWS (PRT239)
34mWhich Vault? Don't tell me your secret(s)!
27mVault At Scale
31mModern Security with Microservices and the Cloud