AWS CloudHSM | General Flashcards

1
Q

What is AWS CloudHSM?

General

AWS CloudHSM | Security, Identity & Compliance

A

The AWS CloudHSM service helps you meet corporate, contractual and regulatory compliance requirements for data security by using dedicated Hardware Security Module (HSM) instances within the AWS cloud. AWS and AWS Marketplace partners offer a variety of solutions for protecting sensitive data within the AWS platform, but for some applications and data subject to contractual or regulatory mandates for managing cryptographic keys, additional protection may be necessary. CloudHSM complements existing data protection solutions and allows you to protect your encryption keys within HSMs that are designed and validated to government standards for secure key management. CloudHSM allows you to securely generate, store and manage cryptographic keys used for data encryption in a way that keys are accessible only by you.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is a Hardware Security Module (HSM)?

General

AWS CloudHSM | Security, Identity & Compliance

A

A Hardware Security Module (HSM) provides secure key storage and cryptographic operations within a tamper-resistant hardware device. HSMs are designed to securely store cryptographic key material and use the key material without exposing it outside the cryptographic boundary of the hardware.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What can I do with CloudHSM?

General

AWS CloudHSM | Security, Identity & Compliance

A

You can use the CloudHSM service to support a variety of use cases and applications, such as database encryption, Digital Rights Management (DRM), Public Key Infrastructure (PKI), authentication and authorization, document signing, and transaction processing.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

How does CloudHSM work?

General

AWS CloudHSM | Security, Identity & Compliance

A

When you use the AWS CloudHSM service you create a CloudHSM Cluster. Clusters can contain up to 32 individual HSM instances spread across multiple Availability Zones, which are automatically synchronized and load-balanced. You receive dedicated, single-tenant access to each HSM instance in the cluster. Each HSM appears as a network resource in your Virtual Private Cloud (VPC). As part of provisioning, you receive administrator credentials for the cluster, and may create other users and administrators as required. Adding and removing HSMs from your Cluster is a single call to the AWS CloudHSM API (or on the command line using the AWS CLI). After creating and initializing a CloudHSM Cluster, you can configure a client on your EC2 instance that allows your applications to use the cluster over a secure, authenticated network connection.

Amazon administrators monitor the health of your HSMs, but do not have any access to configure, manage, or use them. Your applications use standard cryptographic APIs, in conjunction with HSM client software installed on the application instance, to send cryptographic requests to the HSM. The client software maintains a secure channel to all of the HSMs in your cluster and sends requests on this channel, and the HSM performs the operations and returns the results over the secure channel. The client then returns the result to the application through the cryptographic API.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

I don’t currently have a VPC. Can I still use AWS CloudHSM?

General

AWS CloudHSM | Security, Identity & Compliance

A

No. To protect and isolate your CloudHSM from other Amazon customers, CloudHSM must be provisioned inside a VPC. Creating a VPC is easy. Please see the VPC Getting Started Guide for more information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Does my application need to reside in the same VPC as the CloudHSM Cluster?

General

AWS CloudHSM | Security, Identity & Compliance

A

No, but the server or instance on which your application and the HSM client are running must have network (IP) reachability to all HSMs in the cluster. You can establish network connectivity from your application to the HSM in many ways, including operating your application in the same VPC, with VPC peering, with a VPN connection, or with Direct Connect. Please see the VPC Peering Guide and VPC User Guide for more details.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Does CloudHSM work with on-premises HSMs?

General

AWS CloudHSM | Security, Identity & Compliance

A

Yes. While CloudHSM does not interoperate directly with on-premises HSMs, it may be possible move or synchronize keys between them depending on the use case, the type of keys, and the type of on-premises HSM. Please open an AWS Technical Support case in your AWS Console for assistance with this.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

How can my application use CloudHSM?

General

AWS CloudHSM | Security, Identity & Compliance

A

We have integrated and tested CloudHSM with a number of third-party software solutions such as Oracle Database 11g and 12c and Web servers including Apache and Nginx for SSL offload. Please see the CloudHSM User Guide for more information.

If you are developing your own custom application, your application can use the standard APIs supported by CloudHSM, including PKCS#11 and Java JCA/JCE (Java Cryptography Architecture/Java Cryptography Extensions). Support for Microsoft CAPI/CNG is coming soon. Please refer to the CloudHSM User Guide for code samples and help with getting started.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Can I use CloudHSM to store keys or encrypt data used by other AWS services?

General

AWS CloudHSM | Security, Identity & Compliance

A

Yes. You can do all encryption in your CloudHSM-integrated application. In this case, AWS services such as S3 or EBS would only see your data encrypted.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Can other AWS services use CloudHSM to store and manage keys?

General

AWS CloudHSM | Security, Identity & Compliance

A

AWS services do not integrate with CloudHSM directly today. If you want to use the server-side cryptography offered by many AWS services (such as EBS, S3, or RDS), you should consider the AWS Key Management Service. Over time we may integrate CloudHSM with other AWS services. If this is of interest to you, please let us know.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Can CloudHSM be used to perform personal identification number (PIN) block translation or other cryptographic operations used with debit payment transactions?

General

AWS CloudHSM | Security, Identity & Compliance

A

Currently CloudHSM provides general-purpose HSMs. Over time we may provide payment functions. If this is of interest to you, please let us know.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

How does AWS Key Management Service (KMS) compare to AWS CloudHSM?

General

AWS CloudHSM | Security, Identity & Compliance

A

AWS Key Management Service (KMS) is a multi-tenant, managed service that allows you to use and manage encryption keys. Both services offer a high level of security for your cryptographic keys. AWS CloudHSM provides a dedicated, FIPS 140-2 Level 3 HSM under your exclusive control, directly in your Amazon Virtual Private Cloud (VPC).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

When should I use AWS CloudHSM instead of AWS KMS?

General

AWS CloudHSM | Security, Identity & Compliance

A

You should consider using AWS CloudHSM if you require:

Keys stored in dedicated, third-party validated hardware security modules under your exclusive control.

FIPS 140-2 compliance.

Integration with applications using PKCS#11, Java JCE, or Microsoft CNG interfaces.

High-performance in-VPC cryptographic acceleration (bulk crypto).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Will my Safenet-based HSMs be retired?

General

AWS CloudHSM | Security, Identity & Compliance

A

No. While we believe the feature set and cost of the new CloudHSM service offer a far more attractive alternative, we will maintain AWS CloudHSM Classic for existing customers. Resources will be available shortly to assist in migrating from CloudHSM Classic to the new service.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

How do I get started with CloudHSM?

General

AWS CloudHSM | Security, Identity & Compliance

A

You can provision a CloudHSM Cluster in the CloudHSM Console, or with a few API calls through the AWS SDK or API. To learn more, please see the CloudHSM User Guide for information about getting started, the CloudHSM Documentation for information about the CloudHSM API, or the Tools for Amazon Web Services page for more information about the SDK.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly