dustinrcollins
Joined 13 years ago
Karma
216
Submissions
37
Member since
Apr 5
[ my public key: https://keybase.io/dustinmm80; my proof: https://keybase.io/dustinmm80/sigs/to1Z-wR3B-Czo7pbAWV1RaseYN9qXa1bGyOjSv0iTFM ]
View on Hacker NewsRecent submissions
Comment · 10 years ago
Tribalism is really hurting the progress that security folks could be making. Development and operations are starting to collaborate and make huge gains in productivity. Rebranding security as a component of quality can help.
Coming into meetings with other teams with a list of (often unfounded) assumptions does not help anyone. I wrote about this a bit last year: https://blog.conjur.net/devops-and-security-the-five-monkeys
Comment · 11 years ago
The policies look like they'd be a bear to manage since they are path- and not role-based. In order to implement least privilege with multiple actors you'd have to be really careful with your paths.
Example: 2 apps. App 1 needs secrets A B and D. App 2 need secrets A B and C.
So we need to set up our paths in a way that App 1 can get A and B and C, but not D. App 2 needs C but not D. Now when you want to modify secret access from your apps you have to rethink how your paths are set up.
When you're instead assigning permissions to roles this is a lot easier. An example: http://blog.conjur.net/what-is-a-devops-secrets-server
Comment · 11 years ago