Database passwords that expire on their own
Durée: 2:19Anglais
Lumen Pay's reporting job needs to read the payments PostgreSQL database. Instead of one shared password that never changes, a dynamic secret engine in QuantumVault creates a new database user every time it is asked: an admin connection kept encrypted with the company's own key, a creation statement for a read-only user, a revocation statement that drops it, and a lifetime of five minutes. The job gets its credentials, psql logs in and reads the payments, then the lease is revoked and the same login fails, because the user no longer exists. The lease list and Audit Logs show both events. It runs from the portal today, for PostgreSQL and MySQL.