Bio

I have been working with databases for the past 15 years with several DBs (both self hosted and managed).

Talk Description: Ransomware encrypted my first title; this is my backup title.

Hardcoding database credentials in applications or configuration files is a dangerously insecure practice in today's dynamic environments, creating a large attack surface and increasing the risk of credential compromise. It doesn’t matter if they are encrypted, they are still hardcoded in some form. This is further complicated by the need to provide temporary database access to developers and on-call engineers. The increasing frequency of data breaches highlights the urgent need for a more secure solution.
This presentation demonstrates how HashiCorp Vault's database secrets engine can secure PostgreSQL credentials. We'll cover generating short-lived, dynamic credentials for applications and release pipelines, and creating temporary, limited-permission accounts for developers and on-call engineers. The talk will also cover configuring PostgreSQL in Vault, creating Vault roles, integrating applications with Vault, and implementing credential rotation and revocation. Real-world examples and best practices will be shared.
Implementing this solution offers several key advantages. Primarily, it enhances security by significantly reducing the risk of data breaches through the elimination of long-lived credentials and the implementation of the principle of least privilege. It also helps organizations meet regulatory compliance requirements related to data security and access control. Furthermore, the solution streamlines operations by automating credential management, making it easier to manage, rotate, and audit credentials. This leads to increased developer productivity by providing secure and controlled access to database resources when needed without hindering development workflows. Finally, it reduces operational overhead by simplifying the process of managing database access for both applications and personnel.