Clean Up Your Secrets & Credential Management: First Steps With HashiCorp Vault
Feb 03, 2020
Tired of messy, ad hoc management of your API key, credential, and secret management in your applications and microservices? Check out this talk for a new path.
Developers, sysadmins, DevOps engineers are frequently encountering the same security challenges:
- How do you protect API keys, credentials, and other sensitive secrets in your code?
- Where do you store them and how do you share them?
- Can you provision those secrets to an application or another system?
- How do you revoke or rotate a secret to protect from breaches?
This talk from microXchg by the cloud team at DB Schenker outlines the baseline tasks to perform when you realize you need to start securing your application secrets. HashiCorp Vault is a great open source tool that allows teams to do this in a centralized way that security teams can monitor.
How does a secrets management tool change your day-to-day tasks as a developer, operator, or security professional? This talk will walk through the authentication features for securely accessing secrets and demo a few daily secret management tasks in Vault.
In this talk and demo you'll learn
- How to manage application, microservice, and system secrets
- How to control database access for users as well as applications and services
- How to manage password rotation and dynamic secrets
- How to use infrastructure as code tools such as Ansible & HashiCorp Terraform to inject secrets
- How to audit the access and changes made to secrets