Secrets Management: How to (not) help the person who hacks your servers get your data
summary
Concrete breaches and cost numbers drive the content: 1,793 GitHub keys leaked daily and 4.1 billion records exposed in H1 2019 (about 27 million per day), plus a hobby project that triggers a $15,000 AWS bill for 15 minutes and a production outage that costs about $1,000,000 for 16 hours. The talk examines AWS IAM keys, .env and Docker env leaks, demonstrates Hashicorp Vault (dynamic secrets, token rotation, Shamir unseal, HTTP/latency and unseal operational tradeoffs) and when secret management is mandatory.
AI-written summary · about
chapters (17)
- 0:00Intro
- 1:25SECURITY IS IMPORTANT M'KAY
- 2:23TOO MANY SECRETS
- 4:58COST AND SECURITY ARE AFTERTHOUGHT
- 8:14COMMON WAYS OF REVEALING YOUR SECRETS?
- 13:10LESSON IN CHAOS ENGINEERING
- 16:50AN EMAIL A DAY KEEPS THE CHAOS MONKEY AWAY
- 22:27LIABILITY & CRIMINAL NEGLIGENCE
- 24:38CERTIFICATION
- 25:48SECRETS MANAGEMENT APPLICATIONS
- 25:59EASE OF SETUP AND OPERATION
- 26:33SECRET ROTATION
- 27:05DYNAMIC SECRETS
- 30:02AWS SECRETS MANAGER
- 32:16SHAMIR'S SECRET SHARING ALGORITHM
- 33:10VAULT OPERATES EXCLUSIVELY IN A WHITELIST MODE
- 37:28FINAL WORDS
related talks
29mBe nice, help the person who hacks your servers to get your data
33mGaining initial access by exploiting leaked credentials
22mDevSecOps - The Story of 3 Security Breaches
24mHow to Find if Your Developers are Leaking Secrets?
38mAdventures in Cloud Security: What DevOps Can Learn from a Security Engineer
29mBehind Closed Doors: Managing Passwords in a Dangerous World
40mDue to Less Pollution, Secrets Stored on the Cloud are Now Clearly Visible
33mCloud Hacking Scenarios