Re:Uber investigating breach of its computer systems
by badrabbit on Friday September 16, 2022 @07:36PM
(#32873395)
I agree but an api key for a PAM service will get you constrained access (ideally) to a specific resource instead of a kerberos ticket you can take with you as part of your ticket collection. It's supposed to be better but granting the resource permission like GCP does is probably better (but messier too).
[ Parent
| on HN ]
Re:Uber investigating breach of its computer systems
by spydum on Saturday September 17, 2022 @09:44AM
(#32877479)
for sure; the real failure in this setup was again, having a single credential with access to so many other critical secrets. I have yet to see a secret vault that had good analytics for this kind of thing - it assumes you have designed your secret hierarchy and permissions appropriately.
ideally, there would be a warning for identities with access to too many secrets.