Raluca is a Senior Software Engineer in the BullGuard Antivirus Team. With an experience of over 10 years in Security, she was part of a team which won third national prize at the Imagine Cup 2006 contest in Romania with an ML-based software and has a pending patent on a project created during a 2017 BullGuard Hackathon. Also passionate about full-stack architecture and development, she automated platforms used in the AV-product benchmarking and detection testing.

Can Your Cloud Keep a Secret?

Do you know that one line of code could compromise your entire Cloud app? It’s the line with the goody, the secret that unlocks other secrets.
The problem is simple: there is no Cloud without keys to encrypted data and credentials which allow access to various sensitive services. And protecting them in the cloud can be a cumbersome task in a world where most of the applications are de-centralized, both on premises and in the public cloud and with many actors involved. Apart form that, poor architecture and actors lacking full insight into what the other actors are doing can compound the problem.
In fact, poor secrets management can translate into devastating consequences, such as serious sensitive-data breaches, financial losses, negative publicity. From encryption keys and certificates, to database connection strings, API tokens and other sensitive information, we will deep dive you into the secrets of keeping secrets. This problem will be tackled with different strategies, each one with their pros and cons.
This session will help you understand not only how to secure your APIs and applications, safe data handling, access control and authorization, vaults, rotation, and others, but also how to protect secrets when working with orchestrators, containers and microservices in production versus development and testing environments.
In the context of sensitive data still being used in plain text nowadays, secret management design decisions should not be treated as an after-thought, but as one of the pillars of architecting an application.

This talk is co-presented with Cristian Gogosila, Software Developer at the BullGuard Antivirus Team.