VAULT MODERN SECRETS MANAGEMENT CLICK ENGAGE TO RATE - - PowerPoint PPT Presentation

▶
vault
SMART_READER_LITE
LIVE PREVIEW

VAULT MODERN SECRETS MANAGEMENT CLICK ENGAGE TO RATE - - PowerPoint PPT Presentation

Dec 25, 2022 2.12k likes •2.86k views

VAULT MODERN SECRETS MANAGEMENT CLICK ENGAGE TO RATE SESSION RATE 12 SESSIONS AND GET THE SUPERCOOL GOTO PRIZE SETH VARGO @sethvargo SECRET MANAGEMENT WHAT IS "SECRET"? SECRET VS. SENSITIVE SECRET

slide-1
SLIDE 1 VAULT MODERN SECRETS MANAGEMENT
slide-2
SLIDE 2
  • CLICK ENGAGE
TO RATE SESSION RATE 12 SESSIONS AND GET THE SUPERCOOL GOTO PRIZE
slide-3
SLIDE 3

SETH VARGO

@sethvargo
slide-4
SLIDE 4
slide-5
SLIDE 5
slide-6
SLIDE 6

SECRET MANAGEMENT

slide-7
SLIDE 7

WHAT IS "SECRET"?

slide-8
SLIDE 8

SECRET VS. SENSITIVE

slide-9
SLIDE 9
  • SECRET
  • SENSITIVE
slide-10
SLIDE 10
  • SECRET
  • SENSITIVE
DB CREDENTIALS CLOUD ACCESS KEYS SSL CA/CERTIFICATES ENCRYPTION KEYS WIFI PASSWORDS SOURCE CODE
slide-11
SLIDE 11
  • SECRET
  • SENSITIVE
DB CREDENTIALS CLOUD ACCESS KEYS SSL CA/CERTIFICATES ENCRYPTION KEYS WIFI PASSWORDS EMAIL ADDRESSES PHONE NUMBERS MOTHER'S MAIDEN NAME DATACENTER LOCATIONS CUSTOMER PII SOURCE CODE EMAIL/CHAT
slide-12
SLIDE 12
  • SECRET
  • SENSITIVE
DB CREDENTIALS CLOUD ACCESS KEYS SSL CA/CERTIFICATES ENCRYPTION KEYS WIFI PASSWORDS EMAIL ADDRESSES PHONE NUMBERS MOTHER'S MAIDEN NAME DATACENTER LOCATIONS CUSTOMER PII SOURCE CODE EMAIL/CHAT
slide-13
SLIDE 13
  • SECRET
  • SENSITIVE
DB CREDENTIALS CLOUD ACCESS KEYS SSL CA/CERTIFICATES ENCRYPTION KEYS WIFI PASSWORDS EMAIL ADDRESSES PHONE NUMBERS MOTHER'S MAIDEN NAME DATACENTER LOCATIONS CUSTOMER PII SOURCE CODE EMAIL/CHAT
slide-14
SLIDE 14
  • SECRET
  • SENSITIVE
ANYTHING THAT MAKES THE NEWS
slide-15
SLIDE 15
slide-16
SLIDE 16
slide-17
SLIDE 17
slide-18
SLIDE 18

SECRET MANAGEMENT 1.0

slide-19
SLIDE 19 HOW DO I DISTRIBUTE SECRETS? How do applications get secrets? How do humans acquire secrets? How are secrets updated? How is a secret revoked?
slide-20
SLIDE 20 { "mysql_user": "root", "mysql_pass": "s3(Ret" } secure master cat config.son
slide-21
SLIDE 21 WHY NOT CONFIG MANAGEMENT? Centrally stored Eventually consistent No access control No auditing No revocation
slide-22
SLIDE 22 WHY NOT (ONLINE) DATABASES? RDBMS, Consul, ZooKeeper, etc Not designed for secrets Limited access controls Typically plaintext storage No auditing or revocation abilities
slide-23
SLIDE 23 HOW TO HANDLE SECRET SPRAWL? Secret material is distributed Who has access? When were secrets used? What is the attack surface? What do we do in the event of a compromise?
slide-24
SLIDE 24 STATE OF THE WORLD 1.0 Secret sprawl Decentralized keys Limited visibility Poorly defined “break glass” procedures
slide-25
SLIDE 25

SECRET MANAGEMENT 2.0

slide-26
SLIDE 26 VAULT MODERN SECRETS MANAGEMENT
slide-27
SLIDE 27 VAULT GOALS Single source for secrets Programmatic application access (Automated) Operator access (Manual) Practical security Modern data center friendly
slide-28
SLIDE 28 VAULT FEATURES Secure secret storage (in-memory, Consul, file, postgres, and more) Dynamic secrets Leasing, renewal, and revocation Auditing Rich ACLs Multiple client authentication methods
slide-29
SLIDE 29 SECURE SECRET STORAGE Data is encrypted in transit and at rest 256bit AES in GCM mode TLS 1.2 for clients No HSM required
slide-30
SLIDE 30 Success! Data written to: secret/foo secure master vault write secret/foo bar=bacon
slide-31
SLIDE 31 Key Value lease_id secret/foo/2a798f6f-00da-8d48-659a-ef1c969f23ed lease_duration 2592000 lease_renewablefalse bar bacon secure master vault read secret/foo
slide-32
SLIDE 32 DYNAMIC SECRETS Never provide “root” credentials to clients Provide limited access credentials based on role Generated on demand when requested Leases are enforceable via revocation Audit trail can identify point of compromise
slide-33
SLIDE 33 Successfully mounted 'postgresql' at 'postgresql'! secure master vault mount postgresql
slide-34
SLIDE 34 ## DESCRIPTION The PostgreSQL backend dynamically generates database users. After mounting this backend, configure it using the endpoints within the "config/" path. ## PATHS The following paths are supported by this backend. To view help for any of the paths below, use the help command with any route matching the path pattern. Note that depending on the policy of your auth token, you may or may not be able to access certain paths. ^config/connection$ Configure the connection string to talk to PostgreSQL. secure master vault help postgresql
slide-35
SLIDE 35 vault write postgresql/config/connection \ value="user=hashicorp password=hashicorp database=hashicorp" Success! Data written to: postgresql/config/connection secure master \
slide-36
SLIDE 36 vault write postgresql/roles/production name=production Success! Data written to: postgresql/roles/production secure master \
slide-37
SLIDE 37 Key Value lease_id postgresql/creds/production/2d483e34-2d82-476... lease_duration 3600 lease_renewabletrue password 80e6ffa5-d6e9-beb1-e630-9af0c41299bb username vault-root-1432058168-8081 secure master vault read postgresql/creds/production
slide-38
SLIDE 38 Key Value lease_id postgresql/creds/production/a99b952e-222c-6eb... lease_duration 3600 lease_renewabletrue username vault-root-1432058254-7887 password 17a21ba7-8726-97e4-2088-80b7a756702b secure master vault read postgresql/creds/production
slide-39
SLIDE 39 DYNAMIC SECRETS Pluggable Backends AWS, Consul, PostgreSQL, MySQL, Transit, Generic Grow support over time
slide-40
SLIDE 40 LEASING, RENEWAL, AND REVOCATION Every Secret has a Lease* Secrets are revoked at the end of the lease unless renewed Secrets may be revoked early by operators “Break Glass” procedure Dynamic Secrets make leases enforceable Not possible for arbitrary secrets Not possible for transit backend
slide-41
SLIDE 41 AUDITING Pluggable Audit Backends Request and Response Logging Prioritizes Safety over Availability Secrets Hashed in Audits Searchable, but not reversible
slide-42
SLIDE 42 RICH ACLS Role Based Policies Restrict access to “need to know” Default Deny, must be explicitly allowed
slide-43
SLIDE 43 FLEXIBLE AUTH Pluggable Backends Tokens, GitHub, AppID, User/Pass, TLS Certs Machine-Oriented vs Operator-Oriented
slide-44
SLIDE 44 HIGH AVAILABILITY Consul used for leader election Active/Standby Automatic failover
slide-45
SLIDE 45 UNSEALING THE VAULT Data in Vault encrypted Vault requires encryption key Must be provided online
slide-46
SLIDE 46 Sealed: true Key Shares: 10 Key Threshold: 7 Unseal Progress: 6 High-Availability Enabled: false secure master vault status
slide-47
SLIDE 47 Key (will be hidden): secure master vault unseal
slide-48
SLIDE 48 Key (will be hidden): Sealed: false Key Shares: 10 Key Threshold: 7 Unseal Progress: 0 secure master vault unseal
slide-49
SLIDE 49 WATCHING THE WATCHMEN Master Key is the “key to the kingdom” All data could be decrypted Protect against insider attack Two-Man Rule
slide-50
SLIDE 50 SHAMIR SECRET SHARING Protect Encrypt Key with Master Key Split Master Key into N shares T shares to recompute Master Quorum of key holders required to unseal Default N:5, T:3
slide-51
SLIDE 51 SUMMARY Solves the “Secret Sprawl Problem” Protects against external threats (Cryptosystem) Protects against internal threads (ACLs and Secret Sharing)
slide-52
SLIDE 52

BUILDING ON VAULT

slide-53
SLIDE 53 SECURITY FOUNDATION Base of Trust Core Infrastructure Flexible Architecture Foundation for Security Infrastructure
slide-54
SLIDE 54 PERSONALLY IDENTIFIABLE INFORMATION PII information is everywhere SSN, CC#, OAuth Tokens, etc. Email? Physical address? Security of storage? Scalability of storage? Audibility of access?
slide-55
SLIDE 55 PII WITH VAULT “transit” backend in Vault Encrypt/Decrypt data in transit Avoid secret management in client applications Builds on Vault foundation
slide-56
SLIDE 56 TRANSIT BACKEND Web server has no encryption keys Requires two-factor compromise (Vault + Datastore) Decouples storage from encryption and access control
slide-57
SLIDE 57 CERTIFICATE AUTHORITY Vault acts as Internal CA Vault stores root CA keys Dynamic secrets - generates signed TLS keys No more tears
slide-58
SLIDE 58 MUTUAL TLS FOR SERVICES Dynamic CA allows all services to generate keys All internal service communication can use mutual TLS End-to-End encryption inside the datacenter
slide-59
SLIDE 59

VAULT IN PRACTIVE

slide-60
SLIDE 60 USING VAULT API Driven JSON/HTTPS Rich CLI for humans and scripts Rich client libraries
slide-61
SLIDE 61 APPLICATION INTEGRATION Vault-aware Native client libraries (go, ruby, rails, python, node, and more) Secrets only in-memory Safest but high-touch
slide-62
SLIDE 62 CONSUL TEMPLATE INTEGRATION Secrets templatized into application configuration Vault is transparent Lease management is automatic Non-secret configuration still via Consul
slide-63
SLIDE 63 {{ with $secret := vault "postgresql/creds/production" }}
  • production:
adapter: postgresql database: postgres.service.consul username: {{$secret.Data.username}} password: {{$secret.Data.password}} pool: {{key "production/postgres/pool"}} {{ end }} secure master cat secrets.yml.ctmpl
slide-64
SLIDE 64
  • REMEMBER TO
RATE THIS SESSION TWEET @SETHVARGO FOR QUESTIONS TOO
slide-65
SLIDE 65 hashicorp/vault https://vaultproject.io security@hashicorp.com
  • QUESTIONS?
THANK YOU!