Cristian is a Software Developer at the BullGuard Antivirus Team. Since he was eager to learn new things related the AV area, he joined BullGuard since his third year at Faculty of Automatic Control and Computers. He gained his Bachelor’s degree with a URL classifier and became an enthusiast of machine learning and its applicability in Security.

Can Your Cloud Keep a Secret?

Do you know that one line of code could compromise your entire Cloud app? It’s the line with the goody, the secret that unlocks other secrets.
The problem is simple: there is no Cloud without keys to encrypted data and credentials which allow access to various sensitive services. And protecting them in the cloud can be a cumbersome task in a world where most of the applications are de-centralized, both on premises and in the public cloud and with many actors involved. Apart form that, poor architecture and actors lacking full insight into what the other actors are doing can compound the problem.
In fact, poor secrets management can translate into devastating consequences, such as serious sensitive-data breaches, financial losses, negative publicity. From encryption keys and certificates, to database connection strings, API tokens and other sensitive information, we will deep dive you into the secrets of keeping secrets. This problem will be tackled with different strategies, each one with their pros and cons.
This session will help you understand not only how to secure your APIs and applications, safe data handling, access control and authorization, vaults, rotation, and others, but also how to protect secrets when working with orchestrators, containers and microservices in production versus development and testing environments.
In the context of sensitive data still being used in plain text nowadays, secret management design decisions should not be treated as an after-thought, but as one of the pillars of architecting an application.