Iterative Security...
summary
Claims a practical path from bad to better for secrets management using lightweight tools not full Vault and gives timeboxed actions that actually get done. Demonstrates git-crypt, Ansible Vault and Hiera-eyaml and an S3-backed option, runs a DREAD threat model to rank risks, and recommends auditing repos, rotating exposed keys, and limiting master key blast radius. Targets days–weeks implementations under constraints of time complexity and operational risk.
AI-written summary · about
chapters (13)
- 0:00Start
- 10:00Patching!
- 14:36Be Realistic
- 16:56What does our architecture look like?
- 21:14Identify threats
- 21:50Document Threats
- 22:21Rate Threats
- 25:44Constraints: Time
- 26:46Constraints: complexity
- 27:12Constraints: Risk of failure
- 29:09Configuration Management: Puppet
- 30:10Configuration Management: Ansible
- 30:58S3 Buckets
related talks
24mDeveloper-First Application Security and DevSecOps
39mSecurity in a DevOps World
38mKeeping Secrets - A Practical Approach to Managing Credentials
46mThe Nightmare for Attackers: An Infrastructure without Secrets
30mBehind Closed Doors: Managing Passwords in a Dangerous World
29mHow to get dynamic with secrets management
25mIntegrating Vault with CI/CD pipelines: Best practices and pitfalls
29mBehind Closed Doors: Managing Passwords in a Dangerous World