Managing your Secrets in a Cloud Environment
summary
Covers concrete secret management choices and shows a working MVC demo that fetches an API key from Azure Key Vault using managed service identity (no client secret in config). Compares to HashiCorp Vault (Shamir unseal, AES-256-GCM), warns of secret sprawl across VMs and Docker env vars, and offers patterns: short‑lived wrapped tokens, local cached encryption keys to avoid per‑call HSM cost, and per‑row versioned encryption to rotate without a full DB reencrypt.
AI-written summary · about
chapters (42)
- 0:00Intro
- 0:24Is your personal data important?
- 1:30Good old days robbery
- 1:49Today's Robbery
- 2:09Data breach......
- 3:17Consequences
- 3:49System with no Trust
- 4:22Salesman
- 5:42Delivery
- 7:18So what are secrets?
- 8:28Typical Application
- 8:54Storing Configuration in file
- 9:09Multiple application
- 9:30Secret Sprawl
- 9:56Problems
- 11:14Desire secrets
- 11:42What is Azure Key Vault?
- 12:24Gemalto Luna HSM (New)
- 12:42PKCS11 Interop
- 13:27With Key Vault
- 14:18Adding it back to web.config
- 14:32Code that looks like this
- 15:03Managed Service Identity (MSI)
- 15:33Benefits
- 16:07Demo
- 25:08HSBC Hong Kong PayMe Hack
- 26:59HashiCorp Vault
- 27:31Secure Secrets
- 28:31Unsealing the Vault
- 28:55Shamir Secret Sharing
- 29:41Writing Secrets
- 30:08Policy on secrets
- 30:31Reading secrets based on policy
- 30:44Docker and Secrets
- 31:23Mount Temp File System into App
- 32:28Wrap Token for App Secrets
- 33:24Kubernetes with Vault
- 35:33Best Practices or Patterns
- 36:01Cache Aside Encryption Key
- 38:04Tag Version of Encryption Level
- 40:41Advantages
- 41:15Questions?
related talks
10mCan you keep it a secret?
30mSimplifying Secrets Management in the Public Cloud
46mSecrets Management for the Modern Tech. Pro
43mSecure Development
41mModern Security with Microservices and the Cloud
29mManaging Secrets in Your Cloud Environment
56mDiscover the Art of Managing Secrets as a Software Engineer.
12mManage secrets for apps in Azure Spring Cloud with Key Vault