Behind Closed Doors: Managing Passwords in a Dangerous World
summary
Defines secrets as small, radioactive, required items (passwords, tokens, keys) and maps eight infrastructure attack surfaces (brute force, code leak, backup leak, traversal, code execution, containers, laptop theft, legal/APT risks). Recommends HashiCorp Vault or Keywhiz for hot secrets, Amazon S3+IAM/KMS or Sneaker/Confidante for AWS-native flows, Red October for cold key splitting, and HSMs/TPMs for highest assurance (HSM leases cited at ~$16,000/month). Emphasises principle of least privilege, audit logs, secure introduction (instance identity documents, client TLS certs) and to avoid environment variables for secrets.
AI-written summary · about
chapters (44)
- 0:00Intro
- 1:03Definition
- 2:05Secrets
- 2:47Tokens
- 3:09Keys
- 4:00Hot / Online
- 4:24Cold / Offline
- 5:07Slow
- 5:45Fast
- 6:43Properties
- 7:59Surfaces
- 8:12Brute Force
- 9:02Code Leak
- 9:39Backup Leak
- 10:12Traversal
- 11:30Code Exec
- 11:59Root Exec
- 12:25Laptop Theft
- 12:45Higher Power
- 14:05Mode
- 15:37Trusted Third Party TTP
- 16:21Text Files
- 16:47git-crypt
- 17:27Cluster Managers
- 18:03Chef Encrypted Bags
- 18:44Ansible Vault
- 19:38Chef Vault
- 19:57Hashicorp Vault
- 20:34Private S3
- 20:53Amazon KMS
- 21:27Sneaker
- 21:44Confidant
- 21:59Trousseau
- 22:28Sops
- 22:39Red October
- 23:12Barbican
- 25:35Pure Identity
- 26:15API Clients
- 26:33HVAC
- 26:45Config Management
- 27:09KeywhizFS
- 27:47Consul Templates
- 28:13Summon
- 28:28In Summary • Check your privilege and audit trail
related talks
26mHow To Keep A Secret
38mKeeping Secrets - A Practical Approach to Managing Credentials
28mHow to Store Secrets—and When Do You Need Them—in HashiCorp Vault
29mManaging Secrets in Your Cloud Environment
29mBe nice, help the person who hacks your servers to get your data
47mManaging your Secrets in a Cloud Environment
22mFast Secrets: Why Secrets Need to Match the Infrastructure
43mSecret Management with Hashicorp's Vault