Vault provides encryption as a service with centralised key management to simplify encrypting data in transit and at rest across clouds & datacenters.

1. © 2018 HashiCorp
Vault
Cloud Security Automation

2. About HashiCorp
Leading Cloud Infrastructure Automation
Founded
2012
Employees
700
Funding
174M
Our software stack enables the provisioning, securing, connecting
and running of apps and the infrastructure to support them.
We unlock the cloud operating model for every business and
enable their digital transformation strategies to succeed.

3. The Transition to
Multi-Cloud

4. The Transition to Cloud and Multi-Cloud
Traditional Datacenter
“Static”
Modern Datacenter
“Dynamic”
Dedicated
Infrastructure
Private
Cloud
AWS Azure GCP ...+ + +

5. The Transition to Cloud and Multi-Cloud
Traditional Datacenter
“Static”
Modern Datacenter
“Dynamic”
Dedicated
Infrastructure
Private
Cloud
AWS Azure GCP ...+ + +
“Tickets-based” “Self service”

6. The Transition to Cloud and Multi-Cloud
Traditional Datacenter
“Static”
Modern Datacenter
“Dynamic”
Dedicated
Infrastructure
Private
Cloud
AWS Azure GCP ...+ + +
SYSTEMS OF RECORD SYSTEMS OF ENGAGEMENT
“Tickets-based” “Self service”

7. Digital experiences are now the primary
interface between a customer and a
business, or business and business.
Experiences are typically device- and
cloud-first: rich, personal interface, with large
scale data processing and intelligence.
Cloud adoption is a secular trend
This patterns demands a change in the
model for software delivery to meet delivery
goals, and transformation objectives.
Digital transformation means pressure on application delivery

8. Accelerating Application Delivery
Facets of delivering applications
in a multi cloud world
Volume and distribution of services
Ephemerality and immutability
Multiple target environments
?
App
App

9. Reimagining the Stack

10. Reimagining the stack
The implications of the Cloud Operating Model
Provision
Operations
Dedicated servers
Homogeneous
Capacity on-demand
Heterogeneous
STATIC DYNAMIC

11. Reimagining the stack
The implications of the Cloud Operating Model
Secure
Security
High trust
IP-based
Low trust
Identity-based
Provision
Operations
Dedicated servers
Homogeneous
Capacity on-demand
Heterogeneous
STATIC DYNAMIC

12. Reimagining the stack
The implications of the Cloud Operating Model
Connect
Networking
Host-based
Static IP
Service-based
Dynamic IP
Secure
Security
High trust
IP-based
Low trust
Identity-based
Provision
Operations
Dedicated servers
Homogeneous
Capacity on-demand
Heterogeneous
STATIC DYNAMIC

13. Reimagining the stack
The implications of the Cloud Operating Model
Run
Development
Dedicated
Infrastructure
Scheduled across the fleet
Connect
Networking
Host-based
Static IP
Service-based
Dynamic IP
Secure
Security
High trust
IP-based
Low trust
Identity-based
Provision
Operations
Dedicated servers
Homogeneous
Capacity on-demand
Heterogeneous
STATIC DYNAMIC

14. The Cloud Landscape
In search of a common model across multi-cloud environments
Run
Development
Connect
Networking
Secure
Security
Provision
Operations
DEDICATED
PRIVATE
CLOUD
vSphere
Hardware
IP:
Hardware
vCenter
vSphere
Various
Hardware
Identity:
AD/LDAP
Terraform
EKS / ECS
Lambda
CloudApp/
AppMesh
Identity:
AWS IAM
Cloud
Formation
AKS / ACS
Azure Functions
Proprietary
Identity:
Azure AD
Resource
Manager
GKE Cloud
Functions
Proprietary
Identity:
GCP IAM
Cloud
Deployment
Manager
AWS AZURE GCP

15. The HashiCorp Stack
A control plane for every layer of the cloud operating model
Run
Development
Connect
Networking
Secure
Security
Provision
Operations
PRIVATE
CLOUD
AWS AZURE GCP

16. Private Cloud
Cloud Provisioning with Terraform
A common Cloud Operating Model
AWS Azure GCP
Provision
Operations
Secure
Security
Connect
Networking
Run
Development

17. Cloud Provisioning with Terraform
A common Cloud Operating Model
Core + Provider Model
● Expose the unique services of each infrastructure
platform, but provide a consistent workflow

18. Cloud Provisioning with Terraform
A common Cloud Operating Model
Core + Provider Model
● Expose the unique services of each infrastructure
platform, but provide a consistent workflow
● 200+ Providers exist for any infrastructure or
application element
i. Enabled by the open source model of 1200+
contributors

19. Cloud Provisioning with Terraform
A common Cloud Operating Model
A single Terraform template contains the
entire infrastructure topology
● Platform services AND the configuration of
any dependencies
i. eg. 4 AWS services plus k8s

20. Cloud Provisioning with Terraform
A common Cloud Operating Model
Self Service Provisioning
Templates can be made available to
any development team for
self-provisioning
Multi-Cloud Provisioning &
Compliance
Operations teams can enforce security
& policy at provisioning time with
Terraform Enterprise

21. Cloud Provisioning with Terraform
A common Cloud Operating Model
Before
Developer or
CI / CD System
TF CLI
TF Template

22. Cloud Provisioning with Terraform
A common Cloud Operating Model
Codified policies enforce security, compliance, and
operational best practices across all cloud provisioning
Before
Developer or
CI / CD System
TF CLI
TF Template
After
Developer or
CI / CD System
TF CLI
TF Template
TFE
■ Policy
■ Governance

23. Terraform
Provides the foundation for cloud infrastructure automation using infrastructure
as code for provisioning and compliance in the cloud operating model
Multi-Cloud Compliance & Management to
provision and manage any infrastructure with one
workflow
Self-Service infrastructure for users to easily
provision infrastructure on-demand with a library of
approved infrastructure modules
300+
Customers
100K+
Weekly D/Ls
200
Providers
Trusted by:

24. Private Cloud
Cloud Security with Vault
A common Cloud Operating Model
AWS Azure GCP
Provision
Operations
Secure
Security
Connect
Networking
Run
Development

25. Vault
Provides the foundation for cloud security that leverages trusted sources of identity to keep
secrets and application data secure in the cloud operating model
Secrets management to centrally store and
protect secrets across clouds and applications
Data encryption to keep application data secure
across environments and workloads
Advanced Data Protection to secure workloads
and data across traditional systems, clouds, and
infrastructure.
300+
Enterprise
Customers
1M+
Monthly D/Ls
2T+
Transactions
Trusted by:

26. Private Cloud
Cloud Networking with Consul
A common Cloud Operating Model
AWS Azure GCP
Provision
Operations
Secure
Security
Connect
Networking
Run
Development

27. Traditional Networking
A common Cloud Operating Model
A. Provision load-balancers to create static IP
B. Artifact deployed
C. Firewall rule updated to allow traffic
Average time to traffic ~ 6 weeks
Load balancer sprawl ($$!) but also as single
point of failure for each service

28. Networking with Consul
A common Cloud Operating Model
● Service Registry enables Routing
○ From IP-Address to Name
○ Services register and discover each
other. Consul server maintains the map
of service location

29. Networking with Consul
A common Cloud Operating Model
● Service Registry enables Routing
○ From IP-Address to Name
○ Services register and discover each
other. Consul server maintains the map
of service location
○ Consul enables routing directly to
services

30. Networking with Consul
A common Cloud Operating Model
● Service Registry enables Routing
● Service Segmentation for Security
○ Consul Connect enables
service-to-service communication
○ Foundation of zero-trust model
■ “Service Mesh”

31. Networking with Consul
A common Cloud Operating Model
● Service Registry enables Routing
● Service Segmentation for Security
○ Consul Connect enables
service-to-service communication
○ Foundation of zero-trust model
■ “Service Mesh”
A common service registry across heterogeneous environments is the basis
for multi-cloud service networking

32. Consul
Provides the foundation for cloud network automation as a central service
registry for service-based networking in the cloud operating model
50k+
Used at scale with
50k+ agents
1M+
Monthly D/Ls
Service registry & health monitoring to provide a
real-time directory of all services with their health status
Network middleware automation with service
discovery for dynamic reconfiguration as services scale
up, down or move
Zero trust network with service mesh to enable
identity-based security enforced at the endpoints via
sidecar proxies
Trusted by:

33. Private Cloud
Cloud Scheduling with Nomad
A common Cloud Operating Model
AWS Azure GCP
Provision
Operations
Secure
Security
Connect
Networking
Run
Development

34. Principle: Application Orchestration
Vault enables applications and operators to leverage trusted identities and use Vault to broker
access to different clouds, systems, and endpoints.Nomad helps deploy containerized, virtualized or standalone applications on cloud, on-premise
or hybrid infrastructure, with built-in reliability and security

35. Nomad Use Cases
A common Cloud Operating Model
Flexible Container & Workload
Organization
Deploy and manage any
containerized, legacy, or batch
application.
Multi-Cloud Workload Management
Safely manage workloads across
regions and cloud providers
Efficient Resource Utilization
Increase resource utilization, reduce
fleet sizes, and cut costs.

36. Nomad
Provides the foundation for cloud application automation by enabling
workload orchestration in the cloud operating model
Container Orchestration for deploying, managing and
scaling containerized applications
Legacy Application Orchestration to containerize,
deploy and manage legacy apps on existing infrastructure
Batch Workload Orchestration to enable ML, AI, data
science and other intensive workloads in high
performance computing (HPC) scenarios
Trusted by:
4.7k+
GitHub Stars
20k+
Monthly D/Ls

37. A Common Cloud Operating Model to
Accelerate Application Delivery
App
?

38. A Common Cloud Operating Model to
Accelerate Application Delivery
App Operations

39. A Common Cloud Operating Model to
Accelerate Application Delivery
App
Operations
Security

40. A Common Cloud Operating Model to
Accelerate Application Delivery
App
Operations
Security
Networking

41. A Common Cloud Operating Model to
Accelerate Application Delivery
App
Operations
Security
Networking
Development
App

42. A Common Cloud Operating Model to
Accelerate Application Delivery
App
Operations
Security
Networking
Development
App
GOVERNANCE
POLICY

43. © 2018 HashiCorp
Vault
Cloud Security Automation

44. Securing a datacenter was easy...
● All unauthorized traffic or access could be
restricted/blocked
● Networks were trusted and apps and databases
can interconnect with ease
● Four walls and trusted network protected secrets
and sensitive information
But what happens when your apps and infrastructure
extend to the multiple datacenters, cloud, or all the
above?

45. Reimagining the stack
The implications of the Cloud Operating Model
Run
Development
Dedicated
Infrastructure
Scheduled across the fleet
Connect
Networking
Host-based
Dynamic IP
Service-based
Dynamic IP
Secure
Security
High trust
IP-based
Low trust
Identity-based
Provision
Operations
Dedicated servers
Homogeneous
Capacity on-demand
Heterogeneous
STATIC DYNAMIC

46. The Cloud Landscape
In search of a common model across multi-cloud environments
Run
Development
Connect
Networking
Secure
Security
Provision
Operations
DEDICATED
PRIVATE
CLOUD
vSphere
Hardware
IP:
Hardware
vCenter
vSphere
Various
Hardware
Identity:
AD/LDAP
Terraform
EKS / ECS
Lambda
CloudApp/
AppMesh
Identity:
AWS IAM
Cloud
Formation
AKS / ACS
Azure Functions
Proprietary
Identity:
Azure AD
Resource
Manager
GKE Cloud
Functions
Proprietary
Identity:
GCP IAM
Cloud
Deployment
Manager
AWS AZURE GCP

47. 1 2 3
© 2018 HashiCorpVAULT PRINCIPLES
Vault
Principles
API
Driven
Use policy to codify, protect,
and automate access to
secrets.
$ curl
--header "X-Vault-Token: ..."
--request POST
--data @payload .json
https ://127.0.0.1:8200/v1/secret/config
47

48. 1 2 3
© 2018 HashiCorpVAULT PRINCIPLES
Vault
Principles
Secure with any
Identity
Leverage any trusted identity
provider, such as cloud IAM
platforms, Kubernetes, Active
Directory, to authenticate into
Vault.
48

49. 1 2 3
© 2018 HashiCorpVAULT PRINCIPLES
Vault
Principles
Extend
and Integrate
Request secrets for any system
through one consistent,
audited, and secured workflow.
49

50. © 2018 HashiCorpVAULT PRINCIPLE 50
Guiding Principle:
Identity Brokering
● Authenticate and access different clouds, systems,
and endpoints using trusted identities
● Leverage multiple identities across different
platforms with single policy enforcement
● Integrate trusted identities in the same application
workflow to reduce operational overhead

51. Vault
Provides the foundation for cloud security that leverages trusted sources of identity to keep
secrets and application data secure in the cloud operating model
Identity of requester
authenticated against any
identity model prior to
granting access
Policies defined by the
Security team and
enforced at runtime.

52. © 2018 HashiCorp
Use Case
Secrets Management
VAULT ADOPTION
52

53. © 2018 HashiCorpUSE CASE: SECRETS MANAGEMENT
Secrets for applications and systems need to be
centralized and static IP-based solutions don't
scale in dynamic environments with frequently
changing applications and machines.
BEFORE
● Reduced productivity from secret sprawl and
configuration complexity
● Increased cost with redundant management and
difficulty in adopting new systems
● Increased risk with more complexity, thereby
increasing the threat surface and risking
non-compliance with major regulatory laws and
requirements
The ChallengeUse Case:
Secrets
Management
Centrally store, access
and distribute
dynamic secrets
across applications,
systems, and
infrastructure.
53

54. © 2018 HashiCorp
Vault centrally manages and enforces access to
secrets and systems based on trusted sources of
application and user identity.
AFTER
● Increase productivity & reduce time to deploy security
workflows with centralized management
● Control costs with automated compliance and policy
management, controls to support teams to self-manage
their own environments
● Reduce risk with dynamic secrets, control groups, and
other tools to allow Vault to conduct security operations
while protecting sensitive information in flight and at rest.
The SolutionUse Case:
Secrets
Management
Centrally store, access
and distribute
dynamic secrets
across applications,
systems, and
infrastructure.
USE CASE: SECRETS MANAGEMENT 54

55. © 2018 HashiCorp
Use Case
Data Encryption
VAULT ADOPTION
55

56. © 2018 HashiCorpUSE CASE: DATA ENCRYPTION
All application data should be encrypted, but
deploying cryptography and key management
infrastructure is expensive, hard to develop
against, and not cloud or multi-datacenter
friendly.
BEFORE
● Increased costs around HSMs and support
● Reduced productivity with multiple workflows/APIs to
learn cryptographic standards across an organization
and different projects and restricted access to HSMs
● Increased risk with multiple attack surfaces to intercept
and steal sensitive data
The ChallengeUse Case:
Data
Protection
Protect sensitive data
with centralized key
management and
simple APIs for data
encryption.
56

57. © 2018 HashiCorpUSE CASE: DATA ENCRYPTION
Vault provides encryption as a service with
centralized key management to simplify
encrypting data in transit and at rest across
clouds and datacenters.
AFTER
● Reduce costs around expensive HSMs and licensing
● Increase productivity and revenue with a consistent
workflow and cryptographic standards across an
organization
● Reduce risk of data exposure by encrypting sensitive
data in transit and at rest using centrally managed and
secured encryption keys in Vault, all through a single
workflow and API
The SolutionUse Case:
Data
Protection
Protect sensitive data
with centralized key
management and
simple APIs for data
encryption.
57

58. © 2018 HashiCorp
Vault Architecture
58

59. Vault Components

60. © 2018 HashiCorp
Unsealing Vault
60

61. © 2018 HashiCorpVAULT UNSEAL
Shamir’s Secret Vault Unsealing
▪ Protect Encryption Key with Master Key
▪ Split Master Key into N shares
▪ K shares to re-compute Master
▪ Quorum of key holders required to unseal
▪ Default K:5, T:3
Shared keys Master keys Encrypted keys
61

62. © 2018 HashiCorpVAULT UNSEAL
Automated Vault Unsealing
▪ Protect Encryption Key with Master Key
▪ HSM encryption key protects master
key
▪ Communication with HSM via PKCS11
API to decrypt Master Key
HSM key Master keys Encrypted keys
PKCS11
62

63. © 2018 HashiCorpVAULT UNSEAL
Cloud Key Service Automated Vault
Unsealing
▪ Protect Encryption Key with Master Key
▪ Cloud based encryption key protects
master key
▪ Supported cloud services:
▪ Google Cloud Key Management Services
▪ AWS Key Management Services
▪ AliCloud
▪ Azure Key Vault
Cloud based key Master keys Encrypted keys
63

64. © 2018 HashiCorp
Deploying Vault
64

65. © 2018 HashiCorp
Vault Cluster Architecture
Active StandbyStandby
Production
VAULT CLUSTER ARCHITECTURE 65

66. © 2018 HashiCorp
Vault Cluster Architecture
VAULT CLUSTER ARCHITECTURE 66

67. © 2018 HashiCorpDISASTER RECOVERY REPLICATION
Multi-site replication topology
Active Standby
Active Standby
Active Standby
Active Standby Active Standby
Active Standby
Performance
Replication
PerformanceReplication
DR
Replication
DR
Replication
DR
Replication
Active
Cluster
Standby
Cluster
67

68. © 2018 HashiCorp
About Vault
68

69. © 2018 HashiCorpVAULT ADOPTION
About Vault
250+ Enterprise Customers Worldwide
1M+ Monthly Downloads
10.4K+ Github Stars
2T+ Transactions
Product Launch2014
69

70. © 2018 HashiCorp
ORGANIZATIONAL COMPLEXITY
OPEN SOURCE AND ENTERPRISE
Vault
Adoption
Enterprise products
build on open source
to address
organizational
complexity.
Adoption
Open Source Enterprise
Advanced
Scale
Strategic
70
Secrets, identity,
and policy management
Governance & Policy
Multi-datacenter & Scale
Secrets, identity,
and policy management
Advanced Data Protection
Secrets, identity, and policy management

71. © 2018 HashiCorpOPEN SOURCE AND ENTERPRISE
Vault
Packages
Enterprise products
build on open source
to address
organizational
complexity.
ORGANIZATIONAL COMPLEXITY
Secrets, identity,
and policy management
INDIVIDUALS
Open Source Enterprise
Platform
TEAMS
SUPPORT
Secrets, identity,
and policy management
Collaboration & Operations
Enterprise
Modules
ORGANIZATIONS
SUPPORT
Secrets, identity,
and policy management
Collaboration & Operations
Governance
& Multi-datacenter
71

72. www.hashicorp.com
hello@hashicorp.com
Thank you