Cover art for podcast The Python Podcast.__init__

The Python Podcast.__init__

100 EpisodesProduced by Tobias MaceyWebsite

The podcast about Python and the people who make it great

39:03

Managing Application Secrets with Brian Kelly

Summary

Any application that communicates with other systems or services will at some point require a credential or sensitive piece of information to operate properly. The question then becomes how best to securely store, transmit, and use that information. The world of software secrets management is vast and complicated, so in this episode Brian Kelly, engineering manager at Conjur, aims to help you make sense of it. He explains the main factors for protecting sensitive information in your software development and deployment, ways that information might be leaked, and how to get the whole team on the same page.

Preface
  • Hello and welcome to Podcast.__init__, the podcast about Python and the people who make it great.
  • When you’re ready to launch your next app you’ll need somewhere to deploy it, so check out Linode. With private networking, shared block storage, node balancers, and a 40Gbit network, all controlled by a brand new API you’ve got everything you need to scale up. Go to podcastinit.com/linode to get a $20 credit and launch a new server in under a minute.
  • Visit the site to subscribe to the show, sign up for the newsletter, and read the show notes. And if you have any questions, comments, or suggestions I would love to hear them. You can reach me on Twitter at @Podcast__init__ or email hosts@podcastinit.com)
  • To help other people find the show please leave a review on iTunes, or Google Play Music, tell your friends and co-workers, and share it on social media.
  • Join the community in the new Zulip chat workspace at podcastinit.com/chat
  • Your host as usual is Tobias Macey and today I’m interviewing Brian Kelly about how to store, deploy, and use sensitive information in your applications
Interview
  • Introductions
  • How did you get introduced to Python?
  • To begin with, how do you define a secret in the context of an application?
  • What are the broad categories for solutions to secrets management?
  • What are the different aspects of secrets management in the lifecycle of developing, deploying, and maintaining an application?
  • How does the scale of a project or organization impact the strategies that are reasonable for secrets management?
  • What are some of the most challenging aspects of secrets management at the different stages of usage?
    • What are some of the common reasons that secrets management strategies fail?
    • What are some of the vulnerabilities or attack vectors that development teams should be thinking about when working with credentials?
  • What are your thoughts on versioning of secrets?
  • Beyond storing and deploying sensitive information, what are some of the secondary concerns around secrets management that development teams should be thinking about?
  • How does the use of multiple environments (e.g. dev, QA, production, etc.) affect the strategies used for secrets management?
  • What are some of the most useful resources that you have found for anyone looking to learn more about this subject?
Keep In Touch Picks Links

The intro and outro music is from Requiem for a Fish The Freak Fandango Orchestra / CC BY-SA

Listen to The Python Podcast.__init__

RadioPublic

A free podcast app for iPhone and Android

  • User-created playlists and collections
  • Download episodes while on WiFi to listen without using mobile data
  • Stream podcast episodes without waiting for a download
  • Queue episodes to create a personal continuous playlist
RadioPublic on iOS and Android
Or by RSS
RSS feed
https://www.pythonpodcast.com/feed/mp3/