Startseite
Podcasts
Software Engineering Radio - The Podcast for Professional Software Developers Podcast
SE Radio 722: Dwayne McDaniel on the Engineering Challenges of Secrets Management

SE Radio 722: Dwayne McDaniel on the Engineering Challenges of Secrets Management

Software Engineering Radio - The Podcast for Professional Software Developers vor 4 Monaten

0:00

52:10

Dwayne McDaniel, developer advocate at GitGuardian.com, joins
host Priyanka Raghavan to talk about the engineering challenges
of secrets management. They explore what "secrets" really are in
modern systems—far beyond passwords—including API keys, tokens,
certificates, and machine identities, and how "secret sprawl"
emerges across the SDLC.

Drawing on reports from GitGuardian and Verizon, they discuss the
growing scale of secret leaks and why credential abuse and
phishing remain dominant attack vectors.

They examine common leak points—from code repos and logs to CI/CD
pipelines, containers, and SaaS integrations—and how cloud,
DevOps, and AI tooling are amplifying risks. Priyanka quizzes
Dwayne about recent supply chain attacks from pyPi and trivy
ecosystems, highlighting recurring root causes like poor access
control, long-lived credentials, and weak security hygiene.

Finally, they consider detection, response, and modern
solutions—short-lived credentials, secret scanning, and
identity-based approaches like OWASP NHIR and SPIFFE/SPIRE—ending
with practical advice for engineers to reduce blast radius and
design for secure secret lifecycle management.