Do you know where your secrets are? Exploring the problem of secret sprawl and secret management maturity

No ratings

Presented at BSidesLV 2023 by

Dwayne McDaniel

Do you know what Uber, CircleCI, and Toyota all have in common? They had hardcoded credentials in plaintext somewhere in their environments, which led to either a public leak or enabled an attacker to expand their footprint during a breach. It is easy to understand why hardcoding secrets is a problem, but do you know how widespread this problem is or how fast it is escalating? Do you know how it keeps happening? Do you know what you can do about it?