Kubernetes Secrets Management - Securing Your Production Environment
•Download as PPTX, PDF•
0 likes•81 views
“Kubernetes Secrets,” K8s solution for storing application's secrets, does not support segregation when it comes to pods and namespaces, meaning: any pod or namespace may access the entire secrets database on your cluster. As a result, for security reasons, you should not place 2 applications on the same cluster. In this session you would learn the way to enhance Kubernetes architecture in order to overcome this problem, plus get more bonuses as audit and compliance.
Report
Share
Report
Share
Recommended
IBM Secret Key management protoco
1. The document describes an IBM secret key management protocol that provides secure communication between servers and terminals.
2. It uses a tamper-resistant cryptographic facility to securely store the most important keys used to generate encryption keys.
3. The protocol establishes a master key that is used to generate session keys for encryption in a similar manner to the scheme described in a 1978 paper.
Kubernetes Secrets - The Good, The Bad, and The Ugly - Akeyless
Oded Harevern, CEO & co-founder of Akeyless discusses how Kubernetes secrets management is done today and how to do secrets management better.
Learn more about Akeyless Vault Platform for secrets management: https://www.akeyless.io/product-secrets-management/
Watch the video here: https://www.youtube.com/watch?v=hvUuYWXGSJM
The Key to Strong Cloud Security
Secrets management has come a long way - from simple credentials kept in code to KMS tools to privileged access management and then secrets vaults. Digital transformation is still a thing in 2021, and since we’re all using multiple clouds, Kubernetes, and moving towards microservices and serverless architectures, the right tool for the right job is that much more important, especially when it comes to securing your infrastructure and applications.
This talk will discuss some of the history of the movement toward best practices in password, token, key, and credential management, including HSMs, KMSs, PAMs, and PKI management. Finally, how secrets management became a MUST for DevOps and security teams of all enterprises, and why the right tool needs to be cloud agnostic, cloud-native, integrable with any DevOps pipelines and infinitely scalable.
Hardening Kubernetes Cluster
Containers deployments in Kubernetes clusters create both familiar and new security challenges. Given the ephemeral nature of containers, the speed and agility goals of microservices architecture, a preliminary detection of potential risks, and early discovery of viable threats yield the best security outcomes.
Successfully addressing the Kubernetes security challenges requires integrating security into each phase of the container lifecycle: build, deploy, and run.
This webinar will throw light on how to:
* Stay on top of ongoing Kubernetes hygiene by hardening your nodes, employing best practices
* Implement role-based access control of users
* Manage Kubernetes Secrets
* Thwart an attack, with a live demo
Secure Secret Management on a Budget: Reasoning about Scalable SM with Vault ...
Secret-based protocols are the most popular methods for establishing trust in authentication. Unfortunately, they are also one of the first attack surfaces to be probed when system compromise is attempted. Today’s digital services often focus on scalability, high-availability, and fault tolerance, leading to a shift towards microservices on cluster-based architectures. Secret management has evolved as well, leading to the development of cluster-compatible, open-source SM tools such as HashiCorp’s Vault. This talk is designed to help SecOps professionals leverage security concepts such as spatial and temporal attack surfaces, trust, and risk acceptance to secure their cluster credential management.
The Rise of Secrets Management
In this talk, Oded Hareven, Co-Founder & CEO of Akeyless.io, discusses the history of the movement toward best practices in password, token, key, and credential management, including HSMs, KMSs, PAMs, and PKI management. He explores how secrets management is now a MUST for DevOps and security teams of all enterprises and why the right tool needs to be cloud-agnostic, cloud-native, integrable with any DevOps pipelines, and infinitely scalable.
Secrets as Code
You successfully managed to treat your infrastructure as code. And your application config is kept in version control as well. Wait! What did you do with your DB passwords and API tokens? Secrets need special treatment to fully automate your deployment pipeline. In this talk, I will show you how.
Slide deck from my Jazoon TechDays presentation from 7 Sep 2019, recorded here: https://www.youtube.com/watch?v=Ip8eTPj3Jsk
Automation Patterns for Scalable Secret Management
So you’ve scaled your app up to 1000 instances. Do they all share the same credentials for access to stateful resources? Then the attack surface for your stateful resources just got scaled up too. Automated secret management lets you focus on scaling up your app, not your risk of data compromise.
This talk aims to introduce some important considerations in attack surface management at scale, and provide some patterns and tips on integrating secret management workflows into Continuous Deployment infrastructure.
Recommended
IBM Secret Key management protoco
1. The document describes an IBM secret key management protocol that provides secure communication between servers and terminals.
2. It uses a tamper-resistant cryptographic facility to securely store the most important keys used to generate encryption keys.
3. The protocol establishes a master key that is used to generate session keys for encryption in a similar manner to the scheme described in a 1978 paper.
Kubernetes Secrets - The Good, The Bad, and The Ugly - Akeyless
Oded Harevern, CEO & co-founder of Akeyless discusses how Kubernetes secrets management is done today and how to do secrets management better.
Learn more about Akeyless Vault Platform for secrets management: https://www.akeyless.io/product-secrets-management/
Watch the video here: https://www.youtube.com/watch?v=hvUuYWXGSJM
The Key to Strong Cloud Security
Secrets management has come a long way - from simple credentials kept in code to KMS tools to privileged access management and then secrets vaults. Digital transformation is still a thing in 2021, and since we’re all using multiple clouds, Kubernetes, and moving towards microservices and serverless architectures, the right tool for the right job is that much more important, especially when it comes to securing your infrastructure and applications.
This talk will discuss some of the history of the movement toward best practices in password, token, key, and credential management, including HSMs, KMSs, PAMs, and PKI management. Finally, how secrets management became a MUST for DevOps and security teams of all enterprises, and why the right tool needs to be cloud agnostic, cloud-native, integrable with any DevOps pipelines and infinitely scalable.
Hardening Kubernetes Cluster
Containers deployments in Kubernetes clusters create both familiar and new security challenges. Given the ephemeral nature of containers, the speed and agility goals of microservices architecture, a preliminary detection of potential risks, and early discovery of viable threats yield the best security outcomes.
Successfully addressing the Kubernetes security challenges requires integrating security into each phase of the container lifecycle: build, deploy, and run.
This webinar will throw light on how to:
* Stay on top of ongoing Kubernetes hygiene by hardening your nodes, employing best practices
* Implement role-based access control of users
* Manage Kubernetes Secrets
* Thwart an attack, with a live demo
Secure Secret Management on a Budget: Reasoning about Scalable SM with Vault ...
Secret-based protocols are the most popular methods for establishing trust in authentication. Unfortunately, they are also one of the first attack surfaces to be probed when system compromise is attempted. Today’s digital services often focus on scalability, high-availability, and fault tolerance, leading to a shift towards microservices on cluster-based architectures. Secret management has evolved as well, leading to the development of cluster-compatible, open-source SM tools such as HashiCorp’s Vault. This talk is designed to help SecOps professionals leverage security concepts such as spatial and temporal attack surfaces, trust, and risk acceptance to secure their cluster credential management.
The Rise of Secrets Management
In this talk, Oded Hareven, Co-Founder & CEO of Akeyless.io, discusses the history of the movement toward best practices in password, token, key, and credential management, including HSMs, KMSs, PAMs, and PKI management. He explores how secrets management is now a MUST for DevOps and security teams of all enterprises and why the right tool needs to be cloud-agnostic, cloud-native, integrable with any DevOps pipelines, and infinitely scalable.
Secrets as Code
You successfully managed to treat your infrastructure as code. And your application config is kept in version control as well. Wait! What did you do with your DB passwords and API tokens? Secrets need special treatment to fully automate your deployment pipeline. In this talk, I will show you how.
Slide deck from my Jazoon TechDays presentation from 7 Sep 2019, recorded here: https://www.youtube.com/watch?v=Ip8eTPj3Jsk
Automation Patterns for Scalable Secret Management
So you’ve scaled your app up to 1000 instances. Do they all share the same credentials for access to stateful resources? Then the attack surface for your stateful resources just got scaled up too. Automated secret management lets you focus on scaling up your app, not your risk of data compromise.
This talk aims to introduce some important considerations in attack surface management at scale, and provide some patterns and tips on integrating secret management workflows into Continuous Deployment infrastructure.
Let's get started with passwordless authentication using windows hello in you...
This demonstrates deploying your own FIDO authentication infrastructure to your Azure. Deploy a FIDO server and describe how Windows Hello works with the FIDO server. With Windows Hello and FIDO Server, you can implement secure authentication on your infrastructure.
If people is considering passwordless system in their own cloud infrastructure, this session can provide such as their requirement. This shows how to deploy FIDO 1.0, 2 to their infra structure to implement passwordless system in their infrastructure for desktop & mobile.
Global Azure Bootcamp 2017 - Azure Key Vault
Sesión del Global Azure Bootcamp 2017. Azure Key Vault nos permite asegurar los servicios alojados, las claves y contraseñas en un almacenamiento especial y protegido. En esta sesión exploraremos las capacidades de Azure Key Vault y veremos como es necesario su uso en la Star Trek para garantizar la seguridad.
Delivering transparent data_encryption_while_centrally_managing_keys_eskm-blo...
Delivering transparent
data encryption while
centrally managing keys
HPE Enterprise Secure Key Manager for
Bloombase StoreSafe
Stopping the Hassle of SSH keys by using SSH certificates - Community Summit ...
This document discusses using SSH certificates as an alternative to SSH keys for secrets management and remote access. It notes that SSH keys require ongoing management as team members join and leave. SSH certificates were introduced over 10 years ago and provide auditability, expiration to remove standing permissions, and avoid issues with lost or stolen keys. However, SSH certificates require some PKI knowledge and infrastructure setup. The document provides steps to set up a basic certificate authority and configure a server to use SSH certificates for login.
Streamline CI/CD with Just-in-Time Access
Oded Hareven, CEO of Akeyless.io, discusses the hassle of secrets management and how to save time by using dynamic secrets for temporary, just-in-time zero-trust application access for DevOps.
Learn more at https://www.akeyless.io/blog/just-in-time-access-done-right/
Zero trust Architecture
Zero Trust, Zero Trust Network, or Zero Trust Architecture refer to security concepts and threat model that no longer assumes that actors, systems or services operating from within the security perimeter should be automatically trusted, and instead must verify anything and everything trying to connect to its systems before granting access.
Centralize and Simplify Secrets Management for Red Hat OpenShift Container En...
This document provides an overview of a webinar on integrating OpenShift and Conjur for DevOps. It discusses containers and Kubernetes, and how they are not enough on their own for DevOps without additional components like networking, image registries, metrics/logging, deployment automation, application lifecycles, services, and self-service portals. It then outlines how OpenShift addresses these needs and how Conjur can integrate to provide secrets management and access control when using OpenShift for DevOps. The integration goals, components, deployment within OpenShift, and detailed flow are described to securely provide secrets to applications in a scalable and robust manner.
Spring boot-vault
This document outlines a presentation on securing Spring Boot applications with Hashicorp Vault. It introduces Spring Boot and Vault, then describes several demos of integrating Vault to provide dynamic certificates, database credentials, and authentication tokens to a Spring Boot app. The presentation code is provided on GitHub for reference.
Securing sensitive data with Azure Key Vault
As a developer you often have to use & store a lot of sensitive data going from service credentials to connection strings or even encryption keys. But how do I store these in a secure way? How do I know who has access to them and how do I prevent people from copying them and abusing them? On the other hand, SaaS customers have no clue how you store their sensitive data and how they use it. How can they monitor that? How can they revoke your access easily?
Watch the recording here - http://azug.be/2015-05-05---securing-sensitive-data-with-azure-key-vault
Recipe for good secrets management
The document provides a recipe for good secrets management. It outlines requirements like separation of duties, least privilege, leak resistance, and auditing. It recommends having separate security environments for staging and production, designing for "robot" actors with limited access, rotating credentials, and automatically recording system activity. Configuration management and orchestration should provision robots and bootstrap machine identity by assigning credentials from an identity server. Secrets should be fetched from a secrets manager and stored separately from application data to satisfy compliance standards.
Azure key vault
Azure Key Vault is a cloud service that securely stores keys, secrets, and certificates. It allows storing cryptographic keys and secrets that applications and services use while keeping them safe from unauthorized access. Key Vault uses hardware security modules to encrypt keys and secrets. Typical applications would store secrets like connection strings in Key Vault rather than configuration files for improved security and management. Key Vault integrates with Azure Active Directory for authentication so applications can access secrets securely.
CSA Presentation - Software Defined Perimeter
This document discusses security challenges when connecting to applications and provides an overview of the Secure Device Platform (SDP) security model and architecture. The SDP uses a controller and gateways to authenticate devices and users, provision secure connections, and isolate applications. The document also summarizes achievements over the last two years including specification development, hackathons, and workgroups. It outlines the action plan to develop new workgroups and specifications and increase outreach activities.
Microservices security CSA meetup ppt 10_21_2015_v2-2
This document summarizes a presentation on microservices security. It begins with the speaker's qualifications and experience in software architecture. It then defines microservices as small, autonomous services that work together. Key benefits of microservices include technology heterogeneity, resilience, scaling, ease of deployment, and organizational alignment. Common design patterns are proxy, chained, and asynchronous messaging. The presentation discusses security approaches for microservices including HTTPS, SAML, OAuth, and API keys. It provides an example use case and discusses microservices principles and deployment considerations.
.NET Fest 2019. Stas Lebedenko. Practical serverless use cases in Azure with ...
Serverless technology is trending, but in-depth details are missing. How does it fit with non-serverless components? What are the practical use cases? Should you fight vendor lock-in? And what about limits and pitfalls with Azure? I will answer those questions, share a few tricks and short demo.
I'll cover serverless usage scenarios with Azure, what problems can be solved, and what is a viable adoption strategy. Then I'm going to talk about technology shortcomings, when to omit it and how to rip all benefits. There are circumstances when a cloud-agnostic approach is beneficial, so I discuss serverless frameworks too and why vendor lock is not that bad. Finally, we'll look at a short demo that illustrates why you have to use specific serverless patterns.
Deploying Compliant Kubernetes: Real World Edge Cases
This document discusses Lola's deployment of compliant Kubernetes to meet PCI DSS requirements. Lola stores credit card details on behalf of users but does not directly process payments, requiring Level 1 PCI compliance. It outlines how Lola uses technologies like TLS encryption with Ingress controllers, IAM authentication for Kubernetes, and Prometheus for cluster monitoring to meet requirements for firewalls, encryption, secure systems, and access control. The document advises engaging auditors technically rather than treating Kubernetes as a black box, and leveraging open source tools and communities for pre-built applications to simplify compliance tasks like authentication, monitoring, and logging.
ITProceed 2015 - Securing Sensitive Data with Azure Key Vault
Security has become more and more important as we move to the cloud and countries & companies are being hacked – remember the Sony hack? But how do we securely store sensitive data such as connection strings to our databases? Where do we store our encryption keys? Can I share them with my customers? How do I prevent abuse of my secrets and block them from doing so?
That’s what this session is all about – I will introduce you to the concepts of Microsoft Azure Key Vault where you can use this as it allows you to securely store keys, credentials and other secrets in the cloud. We will also have a look at how it enables us to store encryption keys for SQL Server TDE and how it can help you safeguard your cloud solutions even more.
Azure security basics
Azure PaaS and SaaS platforms usage seem to be easy and straightforward, but it's your responsibility to keep them properly secured. I will talk about steps to secure your subscription, network, applications and storage and how Azure can help you with current challenges. Then we talk about security best practices in general, such as user isolation, encryption at rest, certificate and password management with KeyVault. The final topic will explain the basics of disaster recovery plans and why you actually need them.
Security in microservices architectures
Presentation of security in microservices architecture by Maxime Thomas @wascou during #meetup #microservice @meetup_ms_paris
CodiLime Tech Talk - Michał Pawluk: Our deployment of HashiCorp Vault
This document discusses HashiCorp Vault, an open source tool for securely accessing secrets. It provides an overview of how Vault was deployed across multiple Availability Zones on AWS, including the infrastructure setup and access configurations. Automation with Terraform and Packer is also covered. The document concludes with discussing improvements that could be made and taking any questions.
Discover - Securing Your Hybrid Cloud
The document discusses securing hybrid cloud environments. It identifies key security considerations for cloud computing including identity and access control, data protection, application security, and network security. Specific threats to cloud environments are also examined, such as lack of visibility, shadow IT, mobile and IoT risks, and ungoverned collaboration. The document provides recommendations for assessing security needs, integrating operational security controls, and managing mobile device and shadow IT risks. It also includes a brief cloud security checklist covering infrastructure, platform, software, and overall environment security requirements.
Jak využít cloudu pro zvýšení bezpečnosti vašeho IT
This document discusses how Thales can help organizations securely adopt cloud applications and manage access. It notes that single sign-on alone in a hybrid IT environment poses security risks if credentials are compromised. Thales' SafeNet Trusted Access allows validating identities, determining trust levels, and applying access controls for cloud services. It can leverage Windows authentication and PKI to enhance convenience without additional authentication. The document also outlines Thales' key management and encryption solutions for data at rest, applications, big data, and the cloud.
Securing Your Containers is Not Enough: How to Encrypt Container Data
Slides from webinar by Mirantis and Zettaset about how to encrypt containerized data. Watch the recording at: https://bit.ly/container-data-encryption
More Related Content
What's hot
Let's get started with passwordless authentication using windows hello in you...
This demonstrates deploying your own FIDO authentication infrastructure to your Azure. Deploy a FIDO server and describe how Windows Hello works with the FIDO server. With Windows Hello and FIDO Server, you can implement secure authentication on your infrastructure.
If people is considering passwordless system in their own cloud infrastructure, this session can provide such as their requirement. This shows how to deploy FIDO 1.0, 2 to their infra structure to implement passwordless system in their infrastructure for desktop & mobile.
Global Azure Bootcamp 2017 - Azure Key Vault
Sesión del Global Azure Bootcamp 2017. Azure Key Vault nos permite asegurar los servicios alojados, las claves y contraseñas en un almacenamiento especial y protegido. En esta sesión exploraremos las capacidades de Azure Key Vault y veremos como es necesario su uso en la Star Trek para garantizar la seguridad.
Delivering transparent data_encryption_while_centrally_managing_keys_eskm-blo...
Delivering transparent
data encryption while
centrally managing keys
HPE Enterprise Secure Key Manager for
Bloombase StoreSafe
Stopping the Hassle of SSH keys by using SSH certificates - Community Summit ...
This document discusses using SSH certificates as an alternative to SSH keys for secrets management and remote access. It notes that SSH keys require ongoing management as team members join and leave. SSH certificates were introduced over 10 years ago and provide auditability, expiration to remove standing permissions, and avoid issues with lost or stolen keys. However, SSH certificates require some PKI knowledge and infrastructure setup. The document provides steps to set up a basic certificate authority and configure a server to use SSH certificates for login.
Streamline CI/CD with Just-in-Time Access
Oded Hareven, CEO of Akeyless.io, discusses the hassle of secrets management and how to save time by using dynamic secrets for temporary, just-in-time zero-trust application access for DevOps.
Learn more at https://www.akeyless.io/blog/just-in-time-access-done-right/
Zero trust Architecture
Zero Trust, Zero Trust Network, or Zero Trust Architecture refer to security concepts and threat model that no longer assumes that actors, systems or services operating from within the security perimeter should be automatically trusted, and instead must verify anything and everything trying to connect to its systems before granting access.
Centralize and Simplify Secrets Management for Red Hat OpenShift Container En...
This document provides an overview of a webinar on integrating OpenShift and Conjur for DevOps. It discusses containers and Kubernetes, and how they are not enough on their own for DevOps without additional components like networking, image registries, metrics/logging, deployment automation, application lifecycles, services, and self-service portals. It then outlines how OpenShift addresses these needs and how Conjur can integrate to provide secrets management and access control when using OpenShift for DevOps. The integration goals, components, deployment within OpenShift, and detailed flow are described to securely provide secrets to applications in a scalable and robust manner.
Spring boot-vault
This document outlines a presentation on securing Spring Boot applications with Hashicorp Vault. It introduces Spring Boot and Vault, then describes several demos of integrating Vault to provide dynamic certificates, database credentials, and authentication tokens to a Spring Boot app. The presentation code is provided on GitHub for reference.
Securing sensitive data with Azure Key Vault
As a developer you often have to use & store a lot of sensitive data going from service credentials to connection strings or even encryption keys. But how do I store these in a secure way? How do I know who has access to them and how do I prevent people from copying them and abusing them? On the other hand, SaaS customers have no clue how you store their sensitive data and how they use it. How can they monitor that? How can they revoke your access easily?
Watch the recording here - http://azug.be/2015-05-05---securing-sensitive-data-with-azure-key-vault
Recipe for good secrets management
The document provides a recipe for good secrets management. It outlines requirements like separation of duties, least privilege, leak resistance, and auditing. It recommends having separate security environments for staging and production, designing for "robot" actors with limited access, rotating credentials, and automatically recording system activity. Configuration management and orchestration should provision robots and bootstrap machine identity by assigning credentials from an identity server. Secrets should be fetched from a secrets manager and stored separately from application data to satisfy compliance standards.
Azure key vault
Azure Key Vault is a cloud service that securely stores keys, secrets, and certificates. It allows storing cryptographic keys and secrets that applications and services use while keeping them safe from unauthorized access. Key Vault uses hardware security modules to encrypt keys and secrets. Typical applications would store secrets like connection strings in Key Vault rather than configuration files for improved security and management. Key Vault integrates with Azure Active Directory for authentication so applications can access secrets securely.
CSA Presentation - Software Defined Perimeter
This document discusses security challenges when connecting to applications and provides an overview of the Secure Device Platform (SDP) security model and architecture. The SDP uses a controller and gateways to authenticate devices and users, provision secure connections, and isolate applications. The document also summarizes achievements over the last two years including specification development, hackathons, and workgroups. It outlines the action plan to develop new workgroups and specifications and increase outreach activities.
Microservices security CSA meetup ppt 10_21_2015_v2-2
This document summarizes a presentation on microservices security. It begins with the speaker's qualifications and experience in software architecture. It then defines microservices as small, autonomous services that work together. Key benefits of microservices include technology heterogeneity, resilience, scaling, ease of deployment, and organizational alignment. Common design patterns are proxy, chained, and asynchronous messaging. The presentation discusses security approaches for microservices including HTTPS, SAML, OAuth, and API keys. It provides an example use case and discusses microservices principles and deployment considerations.
.NET Fest 2019. Stas Lebedenko. Practical serverless use cases in Azure with ...
Serverless technology is trending, but in-depth details are missing. How does it fit with non-serverless components? What are the practical use cases? Should you fight vendor lock-in? And what about limits and pitfalls with Azure? I will answer those questions, share a few tricks and short demo.
I'll cover serverless usage scenarios with Azure, what problems can be solved, and what is a viable adoption strategy. Then I'm going to talk about technology shortcomings, when to omit it and how to rip all benefits. There are circumstances when a cloud-agnostic approach is beneficial, so I discuss serverless frameworks too and why vendor lock is not that bad. Finally, we'll look at a short demo that illustrates why you have to use specific serverless patterns.
Deploying Compliant Kubernetes: Real World Edge Cases
This document discusses Lola's deployment of compliant Kubernetes to meet PCI DSS requirements. Lola stores credit card details on behalf of users but does not directly process payments, requiring Level 1 PCI compliance. It outlines how Lola uses technologies like TLS encryption with Ingress controllers, IAM authentication for Kubernetes, and Prometheus for cluster monitoring to meet requirements for firewalls, encryption, secure systems, and access control. The document advises engaging auditors technically rather than treating Kubernetes as a black box, and leveraging open source tools and communities for pre-built applications to simplify compliance tasks like authentication, monitoring, and logging.
ITProceed 2015 - Securing Sensitive Data with Azure Key Vault
Security has become more and more important as we move to the cloud and countries & companies are being hacked – remember the Sony hack? But how do we securely store sensitive data such as connection strings to our databases? Where do we store our encryption keys? Can I share them with my customers? How do I prevent abuse of my secrets and block them from doing so?
That’s what this session is all about – I will introduce you to the concepts of Microsoft Azure Key Vault where you can use this as it allows you to securely store keys, credentials and other secrets in the cloud. We will also have a look at how it enables us to store encryption keys for SQL Server TDE and how it can help you safeguard your cloud solutions even more.
Azure security basics
Azure PaaS and SaaS platforms usage seem to be easy and straightforward, but it's your responsibility to keep them properly secured. I will talk about steps to secure your subscription, network, applications and storage and how Azure can help you with current challenges. Then we talk about security best practices in general, such as user isolation, encryption at rest, certificate and password management with KeyVault. The final topic will explain the basics of disaster recovery plans and why you actually need them.
Security in microservices architectures
Presentation of security in microservices architecture by Maxime Thomas @wascou during #meetup #microservice @meetup_ms_paris
CodiLime Tech Talk - Michał Pawluk: Our deployment of HashiCorp Vault
This document discusses HashiCorp Vault, an open source tool for securely accessing secrets. It provides an overview of how Vault was deployed across multiple Availability Zones on AWS, including the infrastructure setup and access configurations. Automation with Terraform and Packer is also covered. The document concludes with discussing improvements that could be made and taking any questions.
Discover - Securing Your Hybrid Cloud
The document discusses securing hybrid cloud environments. It identifies key security considerations for cloud computing including identity and access control, data protection, application security, and network security. Specific threats to cloud environments are also examined, such as lack of visibility, shadow IT, mobile and IoT risks, and ungoverned collaboration. The document provides recommendations for assessing security needs, integrating operational security controls, and managing mobile device and shadow IT risks. It also includes a brief cloud security checklist covering infrastructure, platform, software, and overall environment security requirements.
What's hot (20)
Let's get started with passwordless authentication using windows hello in you...
Let's get started with passwordless authentication using windows hello in you...
Delivering transparent data_encryption_while_centrally_managing_keys_eskm-blo...
Delivering transparent data_encryption_while_centrally_managing_keys_eskm-blo...
Stopping the Hassle of SSH keys by using SSH certificates - Community Summit ...
Stopping the Hassle of SSH keys by using SSH certificates - Community Summit ...
Centralize and Simplify Secrets Management for Red Hat OpenShift Container En...
Centralize and Simplify Secrets Management for Red Hat OpenShift Container En...
Microservices security CSA meetup ppt 10_21_2015_v2-2
Microservices security CSA meetup ppt 10_21_2015_v2-2
.NET Fest 2019. Stas Lebedenko. Practical serverless use cases in Azure with ...
.NET Fest 2019. Stas Lebedenko. Practical serverless use cases in Azure with ...
Deploying Compliant Kubernetes: Real World Edge Cases
Deploying Compliant Kubernetes: Real World Edge Cases
ITProceed 2015 - Securing Sensitive Data with Azure Key Vault
ITProceed 2015 - Securing Sensitive Data with Azure Key Vault
CodiLime Tech Talk - Michał Pawluk: Our deployment of HashiCorp Vault
CodiLime Tech Talk - Michał Pawluk: Our deployment of HashiCorp Vault
Similar to Kubernetes Secrets Management - Securing Your Production Environment
Jak využít cloudu pro zvýšení bezpečnosti vašeho IT
This document discusses how Thales can help organizations securely adopt cloud applications and manage access. It notes that single sign-on alone in a hybrid IT environment poses security risks if credentials are compromised. Thales' SafeNet Trusted Access allows validating identities, determining trust levels, and applying access controls for cloud services. It can leverage Windows authentication and PKI to enhance convenience without additional authentication. The document also outlines Thales' key management and encryption solutions for data at rest, applications, big data, and the cloud.
Securing Your Containers is Not Enough: How to Encrypt Container Data
Slides from webinar by Mirantis and Zettaset about how to encrypt containerized data. Watch the recording at: https://bit.ly/container-data-encryption
Secure Your Encryption with HSM
Hardware Security Modules (HSMs) are widely use for cryptography key management in many areas such as PKI, card payment, trusted platform modules, etc. However they are rarely used in in-house software development.
This presentation will explain about why we need the key management and its fundamental, overview of HSM and how it take parts in key management, HSM selection criterias, and finally, an idea to make a web service wrapper easier to adopt by developers those lack of knowledge in cryptography programming.
Maintaining Trust & Control of your Data in the Cloud
Cloud and Virtualization gives you agility and efficiency to instantly roll out new services and expand your infrastructure. But the lack of physical control, or defined entrance and egress points, bring a whole host of cloud security issues – data co-mingling, privileged user abuse, snapshots and backups, data deletion, data leakage, geographic regulatory requirements, cloud super-admins, and many more. Fortunately, experts agree that encryption is the unifying cloud security control, allowing you protect, control and maintain the trust. Gemalto’s proven encryption and enterprise key management solutions turn any cloud environment into a trusted and compliant environment by solving the critical challenges of data governance, control, and ownership - no matter where you store your data.
Andrew Watts-Curnow, Solutions Architect, Amazon Web Services, ASEAN
Sheung Chi Ng, Senior Security Consulting Manager, Identity and Data Protection (IDP), APAC, Gemalto (Formerly SafeNet)
How to Overcome the Challenges of Cloud Application
What is cloud application development ? Cloud application development is an advancing process of any software which can be implemented in cloud environment.
https://www.embitel.com/cloud-platform-development-support-services
Automate Your Container Deployments Securely
Operations seeking to make their apps and APIs both performant and available to their users must bake effective application security tooling into their processes and infrastructure configurations. How can development and operations teams release at increasing velocity with app protection built into their CI/CD pipeline?
A true next-generation, holistic web application and API protection platform does just that: operations teams can integrate security into their workflows and ensure new infrastructure and app code released to production is both effective and secure in any environment from cloud using containers to datacenters to a hybrid of these.
Join application security expert Aneel Dadani from Signal Sciences to learn how your team can automate, deploy at scale safely while gaining layer 7 visibility in production environments.
Attendees will learn:
What constitutes effective application security within the context of cloud adoption and an ever expanding threat landscape
How development teams can gain visibility into how their apps and APIs are being used in production and what vulnerabilities may exist that they overlooked
How DevOps teams can scale their application footprint to meet demand while securing your codebase in production
How to inspect request traffic at the API gateway or the ingress
Dockerization
Why do we need to Dockerize applications? How do they help? How did we reach using something like Docker?
Learn a bit into these by means of the slides from this talk.
SafeNet overview 2014
SafeNet is a data protection company that protects the world's most sensitive data for trusted global brands. It protects over 80% of global intra-bank fund transfers and nearly $1 trillion per day. SafeNet offers a comprehensive approach to data protection including encryption, key management, and authentication across databases, applications, file servers and more. It has a global footprint in over 100 countries and over 1,500 employees.
AWS live hack: Docker + Snyk Container on AWS
Slides from session 3 of the Snyk AWS live hack series
Dec 15, 2021 with Eric Smalling, Dev Advocate at Snyk, and Peter McKee, Head of Dev Relations & Community at Docker.
Secure channels main deck
Unmatched security for digital data is provided through Secure Channels' patented encryption technology. Their PKMS2 encryption works by breaking files into segments and encrypting each segment with a different encryption key and process, making the encrypted data unusuable even if the private cloud is hacked. Secure Channels also offers language agnostic communication that allows messages to be translated to the recipient's language, as well as cloud security services through their Shield of Certainty Cloud that provides multiple layers of protection from the physical data center to the database.
Webinar hiware
This document provides an overview of NETAND's flagship identity and access management (IAM) product called HIWARE. Some key points:
- HIWARE is an integrated IAM solution developed by NETAND that uses latest technologies like AI and cloud.
- It offers a complete suite of IAM products including identity management, privileged access management, and mobile OTP.
- These products help manage user identities and access across various systems and databases in a centralized manner while enhancing security.
- NETAND has seen consistent growth and profits over years, with HIWARE evolving through several versions to support a variety of IT infrastructures and business needs.
Using Hard Disk Encryption and Novell SecureLogin
The document discusses using hard disk encryption and Novell SecureLogin to protect enterprise data. It describes the challenges of protecting data at rest and in transit. It also discusses regulations and consequences of security breaches. The document then summarizes hardware and software encryption solutions and considerations for implementing encryption on different device types and operating systems. It provides an overview of Novell SecureLogin and demonstrates its use with Microsoft Active Directory and hard disk encryption.
Alex Hanway - Securing the Breach: Using a Holistic Data Protection Framework
From this presentation you will learn:
· A brief history of encryption
· How encryption is now deployed in the enterprise
· Encryption and key management best practices to keep data safe
[API World 2021 ] - Understanding Cloud Native Deployment
Microservices and APIs built for digital transformation products require agile, reliable, and scalable cloud native infrastructure to truly meet customer expectations for a great "always there" user experience. Whether deployed on-premises or hosted in a public cloud, understanding and leveraging the right approach is key to success. This session takes up where the development process leaves off, tracking the standardization of containers and container orchestration for automated deployment, including current and future platform trends WSO2 and others are following.
Big Data security: Facing the challenge by Carlos Gómez at Big Data Spain 2017
This talk gives a technical and innovative overview of how companies can face the challenge of protecting the data and services that are in their data-centric platform, focusing on three main aspects: implementing network segmentation, managing AAA and securing data processing.
https://www.bigdataspain.org/2017/talk/big-data-security-facing-the-challenge
Big Data Spain 2017
16th - 17th November Kinépolis Madrid
Application security meetup - cloud security best practices 24062021
"Cloud Security Best Practices" meetup, is about Secrets Management in the Cloud, Secure Cloud Architecture, Events Tracking in Microservices and How to Manage Secrets in K8S.
Why is the thycotic secret server so important for IT professionals?
The thycotyic secret server comes to your rescue whenever a security breach takes place. Data is the lifeblood of organizations, the need for robust security measures has never been more critical. In this digital era, IT professionals find themselves at the frontline of the battle against cyber threats and data breaches.
Sharing secret keys in Docker containers and K8s
In this talk I will show how to save secret keys in Docker containers and K8s in production and best practices for saving and securing distribution of secrets. With Docker and k8s secrets we can manage information related to keys that are needed at runtime but cannot be exposed in the Docker image or source code repository. These could be the main talking points:
1.Challenges of security and secret keys in containers
2.Best practices for saving and securing distribution of secrets in Docker Containers
3.Managing secrets in Kubernetes using volumes and sealed-secrets
4.Other tools for distributing secrets in containers like Hashicorp Vault and KeyWhiz
Maintaining Trust & Control of your Data in the Cloud
Cloud and Virtualization gives you agility and efficiency to instantly roll out new services and expand your infrastructure. But the lack of physical control, or defined entrance and egress points, bring a whole host of cloud security issues – data co-mingling, privileged user abuse, snapshots and backups, data deletion, data leakage, geographic regulatory requirements, cloud super-admins, and many more. Fortunately, experts agree that encryption is the unifying cloud security control, allowing you protect, control and maintain the trust. Gemalto’s proven encryption and enterprise key management solutions turn any cloud environment into a trusted and compliant environment by solving the critical challenges of data governance, control, and ownership - no matter where you store your data.
Andrew Watts-Curnow, Solutions Architect, Amazon Web Services, ASEAN
Sheung Chi Ng, Senior Security Consulting Manager, Identity and Data Protection (IDP), APAC, Gemalto (Formerly SafeNet)
APIdays Paris 2019 - API Gateway & Identity Providers, a Match Made in Micros...
API Gateway & Identity Providers, a Match Made in Microservices Heaven
Yaara Letz, Consulting Engineer at Tyk.io
Similar to Kubernetes Secrets Management - Securing Your Production Environment (20)
Jak využít cloudu pro zvýšení bezpečnosti vašeho IT
Jak využít cloudu pro zvýšení bezpečnosti vašeho IT
Securing Your Containers is Not Enough: How to Encrypt Container Data
Securing Your Containers is Not Enough: How to Encrypt Container Data
Maintaining Trust & Control of your Data in the Cloud
Maintaining Trust & Control of your Data in the Cloud
How to Overcome the Challenges of Cloud Application
How to Overcome the Challenges of Cloud Application
Alex Hanway - Securing the Breach: Using a Holistic Data Protection Framework
Alex Hanway - Securing the Breach: Using a Holistic Data Protection Framework
[API World 2021 ] - Understanding Cloud Native Deployment
[API World 2021 ] - Understanding Cloud Native Deployment
Big Data security: Facing the challenge by Carlos Gómez at Big Data Spain 2017
Big Data security: Facing the challenge by Carlos Gómez at Big Data Spain 2017
Application security meetup - cloud security best practices 24062021
Application security meetup - cloud security best practices 24062021
Why is the thycotic secret server so important for IT professionals?
Why is the thycotic secret server so important for IT professionals?
Maintaining Trust & Control of your Data in the Cloud
Maintaining Trust & Control of your Data in the Cloud
APIdays Paris 2019 - API Gateway & Identity Providers, a Match Made in Micros...
APIdays Paris 2019 - API Gateway & Identity Providers, a Match Made in Micros...
Recently uploaded
Observability Concepts EVERY Developer Should Know -- DeveloperWeek Europe.pdf
Monitoring and observability aren’t traditionally found in software curriculums and many of us cobble this knowledge together from whatever vendor or ecosystem we were first introduced to and whatever is a part of your current company’s observability stack.
While the dev and ops silo continues to crumble….many organizations still relegate monitoring & observability as the purview of ops, infra and SRE teams. This is a mistake - achieving a highly observable system requires collaboration up and down the stack.
I, a former op, would like to extend an invitation to all application developers to join the observability party will share these foundational concepts to build on:
TrustArc Webinar - 2024 Global Privacy Survey
How does your privacy program stack up against your peers? What challenges are privacy teams tackling and prioritizing in 2024?
In the fifth annual Global Privacy Benchmarks Survey, we asked over 1,800 global privacy professionals and business executives to share their perspectives on the current state of privacy inside and outside of their organizations. This year’s report focused on emerging areas of importance for privacy and compliance professionals, including considerations and implications of Artificial Intelligence (AI) technologies, building brand trust, and different approaches for achieving higher privacy competence scores.
See how organizational priorities and strategic approaches to data security and privacy are evolving around the globe.
This webinar will review:
- The top 10 privacy insights from the fifth annual Global Privacy Benchmarks Survey
- The top challenges for privacy leaders, practitioners, and organizations in 2024
- Key themes to consider in developing and maintaining your privacy program
Cosa hanno in comune un mattoncino Lego e la backdoor XZ?
ABSTRACT: A prima vista, un mattoncino Lego e la backdoor XZ potrebbero avere in comune il fatto di essere entrambi blocchi di costruzione, o dipendenze di progetti creativi e software. La realtà è che un mattoncino Lego e il caso della backdoor XZ hanno molto di più di tutto ciò in comune.
Partecipate alla presentazione per immergervi in una storia di interoperabilità, standard e formati aperti, per poi discutere del ruolo importante che i contributori hanno in una comunità open source sostenibile.
BIO: Sostenitrice del software libero e dei formati standard e aperti. È stata un membro attivo dei progetti Fedora e openSUSE e ha co-fondato l'Associazione LibreItalia dove è stata coinvolta in diversi eventi, migrazioni e formazione relativi a LibreOffice. In precedenza ha lavorato a migrazioni e corsi di formazione su LibreOffice per diverse amministrazioni pubbliche e privati. Da gennaio 2020 lavora in SUSE come Software Release Engineer per Uyuni e SUSE Manager e quando non segue la sua passione per i computer e per Geeko coltiva la sua curiosità per l'astronomia (da cui deriva il suo nickname deneb_alpha).
UiPath Test Automation using UiPath Test Suite series, part 6
Welcome to UiPath Test Automation using UiPath Test Suite series part 6. In this session, we will cover Test Automation with generative AI and Open AI.
UiPath Test Automation with generative AI and Open AI webinar offers an in-depth exploration of leveraging cutting-edge technologies for test automation within the UiPath platform. Attendees will delve into the integration of generative AI, a test automation solution, with Open AI advanced natural language processing capabilities.
Throughout the session, participants will discover how this synergy empowers testers to automate repetitive tasks, enhance testing accuracy, and expedite the software testing life cycle. Topics covered include the seamless integration process, practical use cases, and the benefits of harnessing AI-driven automation for UiPath testing initiatives. By attending this webinar, testers, and automation professionals can gain valuable insights into harnessing the power of AI to optimize their test automation workflows within the UiPath ecosystem, ultimately driving efficiency and quality in software development processes.
What will you get from this session?
1. Insights into integrating generative AI.
2. Understanding how this integration enhances test automation within the UiPath platform
3. Practical demonstrations
4. Exploration of real-world use cases illustrating the benefits of AI-driven test automation for UiPath
Topics covered:
What is generative AI
Test Automation with generative AI and Open AI.
UiPath integration with generative AI
Speaker:
Deepak Rai, Automation Practice Lead, Boundaryless Group and UiPath MVP
20240605 QFM017 Machine Intelligence Reading List May 2024
Everything I found interesting about machines behaving intelligently during May 2024
GraphSummit Singapore | The Art of the Possible with Graph - Q2 2024
Neha Bajwa, Vice President of Product Marketing, Neo4j
Join us as we explore breakthrough innovations enabled by interconnected data and AI. Discover firsthand how organizations use relationships in data to uncover contextual insights and solve our most pressing challenges – from optimizing supply chains, detecting fraud, and improving customer experiences to accelerating drug discoveries.
Introducing Milvus Lite: Easy-to-Install, Easy-to-Use vector database for you...
Join us to introduce Milvus Lite, a vector database that can run on notebooks and laptops, share the same API with Milvus, and integrate with every popular GenAI framework. This webinar is perfect for developers seeking easy-to-use, well-integrated vector databases for their GenAI apps.
Securing your Kubernetes cluster_ a step-by-step guide to success !
Today, after several years of existence, an extremely active community and an ultra-dynamic ecosystem, Kubernetes has established itself as the de facto standard in container orchestration. Thanks to a wide range of managed services, it has never been so easy to set up a ready-to-use Kubernetes cluster.
However, this ease of use means that the subject of security in Kubernetes is often left for later, or even neglected. This exposes companies to significant risks.
In this talk, I'll show you step-by-step how to secure your Kubernetes cluster for greater peace of mind and reliability.
UiPath Test Automation using UiPath Test Suite series, part 5
Welcome to UiPath Test Automation using UiPath Test Suite series part 5. In this session, we will cover CI/CD with devops.
Topics covered:
CI/CD with in UiPath
End-to-end overview of CI/CD pipeline with Azure devops
Speaker:
Lyndsey Byblow, Test Suite Sales Engineer @ UiPath, Inc.
Uni Systems Copilot event_05062024_C.Vlachos.pdf
Unlocking Productivity: Leveraging the Potential of Copilot in Microsoft 365, a presentation by Christoforos Vlachos, Senior Solutions Manager – Modern Workplace, Uni Systems
Artificial Intelligence for XMLDevelopment
In the rapidly evolving landscape of technologies, XML continues to play a vital role in structuring, storing, and transporting data across diverse systems. The recent advancements in artificial intelligence (AI) present new methodologies for enhancing XML development workflows, introducing efficiency, automation, and intelligent capabilities. This presentation will outline the scope and perspective of utilizing AI in XML development. The potential benefits and the possible pitfalls will be highlighted, providing a balanced view of the subject.
We will explore the capabilities of AI in understanding XML markup languages and autonomously creating structured XML content. Additionally, we will examine the capacity of AI to enrich plain text with appropriate XML markup. Practical examples and methodological guidelines will be provided to elucidate how AI can be effectively prompted to interpret and generate accurate XML markup.
Further emphasis will be placed on the role of AI in developing XSLT, or schemas such as XSD and Schematron. We will address the techniques and strategies adopted to create prompts for generating code, explaining code, or refactoring the code, and the results achieved.
The discussion will extend to how AI can be used to transform XML content. In particular, the focus will be on the use of AI XPath extension functions in XSLT, Schematron, Schematron Quick Fixes, or for XML content refactoring.
The presentation aims to deliver a comprehensive overview of AI usage in XML development, providing attendees with the necessary knowledge to make informed decisions. Whether you’re at the early stages of adopting AI or considering integrating it in advanced XML development, this presentation will cover all levels of expertise.
By highlighting the potential advantages and challenges of integrating AI with XML development tools and languages, the presentation seeks to inspire thoughtful conversation around the future of XML development. We’ll not only delve into the technical aspects of AI-powered XML development but also discuss practical implications and possible future directions.
Climate Impact of Software Testing at Nordic Testing Days
My slides at Nordic Testing Days 6.6.2024
Climate impact / sustainability of software testing discussed on the talk. ICT and testing must carry their part of global responsibility to help with the climat warming. We can minimize the carbon footprint but we can also have a carbon handprint, a positive impact on the climate. Quality characteristics can be added with sustainability, and then measured continuously. Test environments can be used less, and in smaller scale and on demand. Test techniques can be used in optimizing or minimizing number of tests. Test automation can be used to speed up testing.
National Security Agency - NSA mobile device best practices
Threats to mobile devices are more prevalent and increasing in scope and complexity. Users of mobile devices desire to take full advantage of the features
available on those devices, but many of the features provide convenience and capability but sacrifice security. This best practices guide outlines steps the users can take to better protect personal devices and information.
How to Get CNIC Information System with Paksim Ga.pptx
Pakdata Cf is a groundbreaking system designed to streamline and facilitate access to CNIC information. This innovative platform leverages advanced technology to provide users with efficient and secure access to their CNIC details.
GraphSummit Singapore | Graphing Success: Revolutionising Organisational Stru...
Sudheer Mechineni, Head of Application Frameworks, Standard Chartered Bank
Discover how Standard Chartered Bank harnessed the power of Neo4j to transform complex data access challenges into a dynamic, scalable graph database solution. This keynote will cover their journey from initial adoption to deploying a fully automated, enterprise-grade causal cluster, highlighting key strategies for modelling organisational changes and ensuring robust disaster recovery. Learn how these innovations have not only enhanced Standard Chartered Bank’s data infrastructure but also positioned them as pioneers in the banking sector’s adoption of graph technology.
Essentials of Automations: The Art of Triggers and Actions in FME
In this second installment of our Essentials of Automations webinar series, we’ll explore the landscape of triggers and actions, guiding you through the nuances of authoring and adapting workspaces for seamless automations. Gain an understanding of the full spectrum of triggers and actions available in FME, empowering you to enhance your workspaces for efficient automation.
We’ll kick things off by showcasing the most commonly used event-based triggers, introducing you to various automation workflows like manual triggers, schedules, directory watchers, and more. Plus, see how these elements play out in real scenarios.
Whether you’re tweaking your current setup or building from the ground up, this session will arm you with the tools and insights needed to transform your FME usage into a powerhouse of productivity. Join us to discover effective strategies that simplify complex processes, enhancing your productivity and transforming your data management practices with FME. Let’s turn complexity into clarity and make your workspaces work wonders!
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
In this session I delve into the encryption technology used in Microsoft 365 and Microsoft Purview. Including the concepts of Customer Key and Double Key Encryption.
20240607 QFM018 Elixir Reading List May 2024
Everything I found interesting about the Elixir programming ecosystem in May 2024
Recently uploaded (20)
Observability Concepts EVERY Developer Should Know -- DeveloperWeek Europe.pdf
Observability Concepts EVERY Developer Should Know -- DeveloperWeek Europe.pdf
Cosa hanno in comune un mattoncino Lego e la backdoor XZ?
Cosa hanno in comune un mattoncino Lego e la backdoor XZ?
UiPath Test Automation using UiPath Test Suite series, part 6
UiPath Test Automation using UiPath Test Suite series, part 6
20240605 QFM017 Machine Intelligence Reading List May 2024
20240605 QFM017 Machine Intelligence Reading List May 2024
GraphSummit Singapore | The Art of the Possible with Graph - Q2 2024
GraphSummit Singapore | The Art of the Possible with Graph - Q2 2024
Introducing Milvus Lite: Easy-to-Install, Easy-to-Use vector database for you...
Introducing Milvus Lite: Easy-to-Install, Easy-to-Use vector database for you...
Securing your Kubernetes cluster_ a step-by-step guide to success !
Securing your Kubernetes cluster_ a step-by-step guide to success !
UiPath Test Automation using UiPath Test Suite series, part 5
UiPath Test Automation using UiPath Test Suite series, part 5
Climate Impact of Software Testing at Nordic Testing Days
Climate Impact of Software Testing at Nordic Testing Days
National Security Agency - NSA mobile device best practices
National Security Agency - NSA mobile device best practices
How to Get CNIC Information System with Paksim Ga.pptx
How to Get CNIC Information System with Paksim Ga.pptx
GraphSummit Singapore | Graphing Success: Revolutionising Organisational Stru...
GraphSummit Singapore | Graphing Success: Revolutionising Organisational Stru...
Essentials of Automations: The Art of Triggers and Actions in FME
Essentials of Automations: The Art of Triggers and Actions in FME
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Kubernetes Secrets Management - Securing Your Production Environment
- 1. Kubernetes Secrets Securing Your Production Environment Ori Mankali, VP R&D, Akeyless
- 2. Unique Zero- Knowledge KMS Technology Akeyless DFC™ Secrets Management SaaS Platform Akeyless Vault Platform Secrets Management as-a-Service Serving market leaders enterprises Pharma, Insurance, Adtech, Online, E- commerce, Gaming
- 3. What are secrets and why are they important? ● Tokens, API keys, Encryption Keys, Passwords, etc. ● Needed for most types of applications and services to authenticate to various resources ● Main concern: Protection ○ Hacking ● Secondary concern: Management and Traceability ○ Revocation ○ Audit logs
- 5. How does K8s store secrets? ● K8s is one of the most popular container orchestration tool ● It’s becoming the backbone of modern infrastructure ● Many application still store secrets as plain text ● Built-in secret store, not much better
- 6. So, how can I make my production env. safer? ● Strong encryption algorithm ● Encryption key storage may lead to Secret-Zero problem ● What about Application-rich clusters?
- 7. Problem #2 Segregation of pods & namespaces
- 8. Secret secured, almost ● Need to ensure different applications within a cluster can’t access secrets of other applications ● Segregate to apply Least Privilege Access ● But who can access my cluster?
- 10. Just-in-Time K8s access ● Short-lived PKI certificates or short-lived temporary Service Account tokens ● You will also get: Traceability, Governance and management ● Access Revocation to quickly respond to security incidents
- 11. The Solution ● A Secret Management Platform that protects your secrets (decryption at application level) and allowing controlled access to your cluster ● Trusted Machine Identity (Cloud IAM, Akeyless Universal Identity, Service Accounts) - to address the Secret Zero Problem ● Using either: ○ Self Deployed Solutions ○ SaaS Platforms
- 12. Demo Time