Breaking Up with Long-lived Secrets: Secure Automation in the Mode...
summary
Long‑lived pipeline credentials remain an Achilles’ heel; replacing them with short‑lived, context‑bound tokens issued via OIDC federation lets CI systems, package publishers and signing tools mint minutes‑long creds tied to workload identity. Several ecosystems now permit ephemeral publish and signing flows for containers, VMs and libraries, eliminating stored passwords, cutting exposure windows from indefinite to minutes, and fitting into layered defenses; adopters report simpler rotation and far fewer secret‑leak incidents.
AI-written summary · about
related talks
45mAttackers' Nightmare: An Infrastructure Without Secrets
34mSecuring your CICD Pipeline
33mAre your Pipelines Secure? Lock-down unsecured CI/CD Pipelines
22mFast Secrets: Why Secrets Need to Match the Infrastructure
49mEnhancing CI/CD Secrets Security: The 3Rs Approach
40mAre your CI/CD Pipelines Secure?
30mLong Live Short Lived Credentials - Auto-rotating Secrets At Scale
46mThe Nightmare for Attackers: An Infrastructure without Secrets