Encrypting Your Infrastructure Without Getting Fired

No ratings

Presented at BSidesSATX 2025 by

As we push things like Kubernetes clusters to edge installations for reduced latency and increased availability, how protected are they against crowbar theft? Encrypting their disks reduces these risks, but then you discover corner cases in production where your servers aren't automatically decrypting, and you've effectively DoSed yourself. Oops. We'll explore an alternative with network-based decryption without escrow or proprietary hardware using the Open Source Linux tools Tang and Clevis.