why use HSM(Hardware Security Module) ? What to look for in a HSM?

Let's answer first why ? Why a HSM should be used?
We all know security has sort of become a myth. Specially in today's interconnected, big data, cloud crazy world. The questions is How to secure data ? documents ? keys? passwords?

Very sensitive applications have to protect several different forms of data and in some industries (banking, health, complaint heavy ones) we absolutely can not overlook the possibility of security compromises.

Solutions with various encryption technologies came up when the field of security was burgeoning but they were only safe as long as the keys are safe . How do you keep the keys safe? Store your software key in some software? NAAA!! that won't work.
Store them in tapes like Millitary ? NAAA!! that won't work
Store them in a tamper proof hardware with multiple level of authentications? May be !!  atleast to some extent!

That's where Hardware Security Module HSM comes into play (added bonus it can help you clear  your industry's security compliance needs )

Now that we know why ( and there are more use cases here  if you still need more reasons) the nest question is what to look for in an HSM?

Lets list the technical factors that might help  :-

• Performance -  encryption/decryption/key generation/signing, symmetric, asymmetric, decide based on your application needs
• Redundancy - consider the failover cases, how often can it happen? How easy is it to replace it? Assess the impact of it on your operations and have a plan in place and in case that happens or look for a more robust one. Dual NIC or not , down time e.t.c are questions to be asked.
• Backups - No matter how robust HSM is you can not afford to not think about backups because of the very real possibility of loosing access to your data forever. Consider how easy it is to backup your data (in a secure way ofcourse) , restore your data in HSM. 
• Scalability -  Most HSMs have limit on slots available, number of keys you can stores, number of users you can add e.t.c e.t.c Have the scale in mind. What if you need to scale up or down ( for cost cutting) 
• Procedures - Lets face it .. using HSM is not gonna make things simple .. its gonna make them more complex.  The real cost of using HSM is felt in operations because of the complexity that is introduced.A good HSM will come with a detailed usage manual which describes how things should be done to make sure its used correclty. It's not the hardware which matters, but how you use it. So consider APIs, Device management options , customer support , policy level controls , configuration options  e.t.c
• Physical/Logical Security -  Ofcourse all HSMs should be able to tackle physical or logical hacking in to the hardware/software of HSM. Most HSMs as a result have tamper proof cases, hardcase ,  multiple level of authentications and "wipe everyhting" attitude for intrusion attacks. 
• Complaince - If you have any compliance requirements make sure HSM supports it.

Safenet Hardware Security Module configuration for the first time.

Safenet HSM comes with a lot of documentation .. which is good .. the sad part is  I found it a little too verbose.
if you want to read it all here is the link
http://cloudhsm-safenet-docs-5.3.s3-website-us-east-1.amazonaws.com/007-011136-006_lunasa_5-3_webhelp_rev-c/startpage.htm

If you juts got the hardware and want to know how to configure it quickly here are the steps

1. connect to the serail console 
2. login with default appliance credentials if you are logging in for the first time (admin , PASSWORD)
3. Change Password:as soon as you do that you will be asked to change the password ( atleast 3 characters from the these categories letters, numbers, special characters)
4. using h or ? you can get a list of commands
5. You can change/recover passwords (Note is this "appliance admin password" write it down carefully)
6. Sett time zone Next check date, time, zone :-
   lunash:>status date
   lunash:>status time
   lunash:>status zone
7. if its incorrect set it up correctly using :-
   lunash:>sysconf timezone set America/Chicago
   *** note above 7 steps will be done the first time HSM is powered on****
8. configure network (hostname, domain, interfaces)
   lunash:> network hostname yourhostname 
   lunash:> network domain yourdomain
   lunash:>net interface  -device eth0 -ip 1.1.1.1  -netmask 255.255.255.255 -gateway   1.2.2.3.
9. verify network  configuration (Note: make sure links are up..else go check on the eth port connections, ping ips to verify )
   lunash:>net show
   
   net-show

   
   

     [yourHSM] lunash:>net show                        
   
   
      Hostname:          "yourhostname"
      Domain:            "yourdomain"
   
      IP Address (eth0): 1.1.1.1
      HW Address (eth0): 00:00:00
      Mask (eth0):       255.255.255.255
      Gateway (eth0):    1.2.2.3
   
      Name Servers:      10.0.80.11        10.0.80.12    
      Search Domain(s):  softlayer.local 
   
   Kernel IP routing table
   Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
   1.1.1.1        0.0.0.0         255.255.255.255          U     0      0        0 eth0
   1.0.0.0        1.2.2.3          255.0.0.0                  UG    0      0        0 eth0
   
   Link status
     eth0: Configured   
           Link detected: yes
   
     eth1: Not configured
10. Generate certificate: Certificate can be generated following ways (use the ip if you do not have DNS configured)
    lunash:>sysconf regenCert
    lunash:>sysconf regenCert 11.1.1.1
11. lunash:>ntls bind eth0

Now if you want you can go further and start playing with it.

1. Initialize HSM :
   lunash:>hsm init -label myhsm -domain thisiscliningdomain -password *** -force
2. Create Partition:
   lunash:>hsm login
   lunash:>partition create -partition myPartition1
    

Hardware Security Module :- lock your master key and never let it leave

A hardware security module (HSM) is a physical computing device that safeguards and manages digital keys for strong authentication and provides cryptoprocessing. These modules traditionally come in the form of a plug-in card or an external device that attaches directly to a computer or network server.  (from wiki)




A hardware security module (HSM) is a physical device that provides secure storage for encryption keys. It also provides secure computational space (memory) to perform encryption and decryption operations.

HSM provides secure cryptographic key storage and operations within a tamper-resistant hardware device.HSM is worth looking into ,Whenever security, compliance, key management e.t.c are of utmost importance.
A hardware security module can be employed in any application that uses digital keys. Typically the keys must be of high-value - meaning there would be a significant, negative impact to the owner of the key if it were compromised.
The functions of an HSM are:

• onboard secure cryptographic key generation
• onboard secure cryptographic key storage and management
• use of cryptographic and sensitive data material
• offloading application servers for complete asymmetric and symmetric cryptography.

Here we list some uses cases, practical/possible applications of HSM :-

• Database -TDE( transparent data encryption):-
  Several commercial database engines support a feature called transparent data encryption (TDE) that can seamlessly encrypt the data in a database.Transparent data encryption can use HSM to provide enhanced security for sensitive data. An HSM is used to store the master encryption key used for transparent data encryption. The key is secure from unauthorized access attempts as the HSM is a physical device and not an operating system file. All encryption and decryption operations that use the master encryption key are performed inside the HSM. This means that the master encryption key is never exposed in insecure memory.
• Cryptographic accelerator:-
  HSM delivers significant performance benefits and reduces hardware costs. HSMs can provide significant CPU offload for asymmetric key operations. Can not compete with hardware-only solutions for symmetric key operations though. Performances ranges from 1 to 7,000 1024-bit RSA signs/second.
•  Compliance sensitive industries:-
  wherever data is sensitive , critical and highly personal it needs to be encrypted. Healthcare industry , Legal industry, Finance industry, government, banks... all have to deal with lot of compliance clearance to make sure their data/documents/information is all using high standard encryption and key management standards.. HSMs can help in enforcing PCI DSS, PCI PTS compliance , DES compliance, FIPS compliance , HIPAA compliance,  TR-39 compliance. Mostly all follow the sign and decrypt data, but the private keys are located at a HSM model
• Certificate Management:-
   HSM  can also be used as service to generate certificates, sign certificate signing requests (CSRs), and to store private keys used with certificates. The CloudHSM is typically used as an architectural building block and root of trust in these applications
•  EMV data preparation and card personalization
•  Remote key loading for ATM networks
•  Point-to-Point Encryption (P2PE) of cardholder data
•  Credit, debit, and prepaid card fraud prevention
•  MAC calculation to ensure integrity of data in transit and at rest
•  Dynamic key exchange for Point of Sale and ATM
•  PIN translation and verification
•  One-time password generation for online security :-
  Most OTP (One Time Password) solutions are based on a long secret random seed value. Somehow this needs to be stored at the validating server as well to be able to verify the submitted OTP value.
  In a way these seeds have the same role as user supplied passwords and need to be stored equally secure. Salting & hashing will not work here as this will break the OTP algorithm.
  Most small OTP-tokens are physically secured by being more or less tamper-proof but this does not apply to the server.Do all cryptographic computations in the HSM
• SSL offloading

• Sample Applications:

  • PKI key generation & key
  • Storage (online CA keys & offline CA keys)
  • Certificate validation & signing
  • Document signing
  • Transaction processing
  • Database encryption
  • Smart card issuance

  - See more at: http://www.safenet-inc.com/data-encryption/hardware-security-modules-hsms/luna-hsms-key-management/luna-sa-network-hsm/#content-left