Thibault Lengagne: The Nightmare for Attackers: An Infrastructure without Secrets

This talk, led by Thibault Lengagne, addresses the complexities of secret management in IT environments, highlighting the risks associated with stolen secrets, which account for a significant percentage of cyberattacks. The speaker explores the possibility of creating a secret-free infrastructure, leveraging recent advancements in technologies such as Single Sign-On (SSO), OpenID Connect (OIDC), Cloud Identity and Access Management (IAM), and Just-in-Time access. Through concrete case studies, Thibault demonstrates methodologies to eliminate long-term secrets used by developers and discusses automated tools for rotating secrets employed by machines. Attendees will gain insights into best practices and tools necessary to establish a 'Zero-Creds' architecture in their ecosystems.