What can be used to limit the scope of a credential breach?

Storing secrets in a distributed ledger does not inherently limit the scope or impact of a credential breach if the secrets themselves are static and long-lived once compromised.

Enabling audit logging provides visibility into who accessed what and when, which is crucial for incident response, but it does not prevent or limit the scope of a breach itself.

Short-lived dynamic secrets are automatically generated by Vault for a specific purpose and expire after a short, predefined period, significantly reducing the window of opportunity for an attacker to use compromised credentials even if they are breached. This mechanism inherently limits the 'blast radius' of a compromised credential by making it invalid quickly.

Sharing credentials between applications is a poor security practice that increases the blast radius of a credential breach, as one compromised application can expose credentials used by many others.