HashiConf 2018 Keynote: Cruise Automation and Vault

Transcript

Thank you. Good morning, everyone. How are you doing today? My name’s Brian Nuszkowski. I’m a security engineer at Cruise Automation, here in San Francisco.

How many of you want to be able to drive a car and not actually drive the car? Like maybe read a book, or eat a burrito, or whatever other things you want to do? Maybe it’s sleep or work? That’s what we’re working on at Cruise Automation. We call it the driverless revolution of autonomous vehicles.

As a security engineer, you can imagine it’s pretty difficult to try to secure something like an autonomous vehicle, which is a hard project to solve. We have 3 core problems we’re looking to solve in the security of our AVS.

One is the generic, standard secrets delivery, obviously. Everyone has this problem. “How do I get secrets from point A to point B?”

The next problem is, “Well, if I’m going to get those secrets from point A to point B, how am I going to do that? How do I authenticate this thing that is essentially a robot? It is no longer a computer or a web app.” How do we shift our thinking of, “We authenticate traditional things, now it’s this thing that’s out in the real world and we have to prove that is who it says it is?”

Lastly, “How do we make sure that this vehicle is talking to other services that it is required to talk to in order to properly operate and function and do things like take you where you want to go?”

In trying to solve this, we essentially chose Vault to do that. For standard secrets delivery, we just used whatever is possible to leverage the secret engines that HashiCorp delivers to us. For more complicated things, like maybe component or vehicle authentication, we use a combination of public key infrastructure, primitives, and a lot of custom plug-in development.

Now that this thing is able to authenticate, get secrets, now it’s got to talk to other stuff. We thought, “Well, since we already have Vault in our ecosystem across other applications, why don’t we use it as the central message broker?” For that, we used Sentinel, which I’m sure you’ll hear more about today.

See Brian's talk: Vault at GM Cruise: Securing Autonomous Vehicles and the Humans Who Build Them