CloudHSM Flashcards
CloudHSM
What is the major security limitation of KMS?
Shared hardware. HSM modules aren’t single-tenant
CloudHSM
What is CloudHSM compared to KMS?
important
True single-tenant HSMs, managed by AWS
CloudHSM
Major warning about CloudHSM use?
AWS has no access to the device. Lose access == all keys lost
CloudHSM
What is the FIPS standard for CloudHSM?
important
FIPS 140-2 level 3
need to know whole thing incl “L3” at end
CloudHSM
How do you access a CloudHSM device?
important
PKCS#11, Java Crypto Extensions (JCE), Microsoft CryptoNG library
CloudHSM
Why not just use AWS web service APIs?
CloudHSM not integrated with AWS, it’s an industry standard hardware device
CloudHSM
What other system uses HSMs too?
KMS
CloudHSM
What overlap is there between CloudHSM and KMS?
Normal KMS is shared tenant HSM. Custom Key Store feature of KMS uses CloudHSM for single-tenant.
CloudHSM
Is a CloudHSM device HA?
Nope, physical device, so lives in a single AZ
CloudHSM
Is CloudHSM product HA?
Yes(-ish), as long as your Cluster has more than 1 device
CloudHSM
How do you provision CloudHSM?
Create a Cluster, add 1+ devices to it
CloudHSM
How do you provision a CloudHSM device into a VPC?
Don’t. It’s the RDS model: devices live in Service team’s VPC, you get one ENI per device
CloudHSM
If you have two CloudHSMs, and HSMs don’t ever let keys out…
HSMs in a Cluster sync their keys and config
CloudHSM
Once you have two ENIs for your 2-node CloudHSM cluster, now what?
Run the CloudHSM agent on every EC2 node
CloudHSM
What AWS services does CloudHSM integrate with?
important
Essentially none
CloudHSM
Concrete result of integration strategy with other AWS services?
important
No CloudHSM support for encrypting EBS volumes, S3 objects, …
CloudHSM
How can CloudHSM benefit an application other than by increasing security?
important
Speed up a web server by offloading SSL/TLS to the CloudHSM device
CloudHSM
How can CloudHSM benefit Oracle databases?
important
Enable Transparent Data Encryption (TDE): Oracle offloads data encryption to CloudHSM
CloudHSM
What can CloudHSM do to protect certificates?
Store the issuing certificate in CloudHSM for a Certificate Authority
CloudHSM
What system is best for handling keys using industry standard interfaces?
important
CloudHSM
CloudHSM
How can CloudHSM benefit your custom CA?
important
Store private (root) keys in CloudHSM
same tech for DNS root signing ceremony
