Who's managing the credential for your data infrastructure?
summary
Claims that 80% of breaches trace to poor or reused passwords and demonstrates replacing static DB credentials with HashiCorp Vault issuing timebound secrets. Demo builds Postgres credentials via the DB secret engine, grants a role that can only read a public table, issues one hour TTL passwords, and enables audit logging (HMAC-SHA256 hashed entries). Generated credentials authenticate and enforce authorization, sensitive rows remain inaccessible, and audit hashes let admins verify who used which lease.
AI-written summary · about
chapters (16)
- 0:00Data infrastructure security intro
- 3:24Speaker and session overview
- 4:47Database access and secret sprawl
- 6:58AAA model for security
- 9:23Dynamic credentials solution
- 11:53Choosing secret management tool
- 13:18Static vs dynamic credentials
- 14:23Vault architecture
- 15:48Demo setup and provisioning
- 17:15Tables and access rules
- 18:00Vault for dynamic credentials
- 20:27Generating dynamic credentials
- 21:53Testing auth and authorization
- 22:58Vault auditing features
- 25:47Break glass procedures
- 26:30Resources and closing
related talks
44mWho's managing the credentials for your database?
40mA Better Way To Manage Secrets
53mDynamic Database Credentials
32mThe End of Shared Passwords with Vault and Boundary
43mSecret Management with Hashicorp's Vault
27mStop the (Password) Insanity! - Managing Credentials with HashiCorp Vault
38mKeeping Secrets - A Practical Approach to Managing Credentials
44mSecret Management with Hashicorp's Vault