CODEWITHSUNDEEP
securityencryption
foureight84
foureight84

Reputation: 402

hardware security modules and storing credit card numbers

Currently working on a project that requires credit card storage. In order to comply with PCI-DSS level 1 standard, the credit card numbers have to be encrypted through the use of an HSM.

  1. How does the use of an HSM differ from a self brewed encryption?

  2. If the encrypted data has been stolen, and said person gains access to the project code, wouldn't this compromise the encrypted data regardless of HSM usage or self encryption?

  3. In the event of intrusion, how does HSM detect and alert?

I am asking to get a general direction to get started with my research to see which type of HSM to obtain and how to implement it securely.

Upvotes: 1

Views: 414

Answers (2)

Esat
Esat

Reputation: 21

In the event of intrusion, how does HSM detect and alert?

HSMs have their own tamper protection, detection system. When someone tries to access HSM physically, it automatically deletes the master key. Because of tamper protection, there will be no more useful sensitive data for attackers

Upvotes: 1

Little Code
Little Code

Reputation: 1545

How does the use of an HSM differ from a self brewed encryption?

Answer me this.... how do you propose to securely store your keys in your self-brewed encryption ?

As the old IT saying goes ... "cryptography is hard, don't try to re-invent the wheel unless you REALLY know what you're doing, and even then, only do so if you REALLY have to".

HSM is public key encryption (and signing). The private key lives on the HSM and never, ever leaves. The manufacturers explicitly and deliberately do not provide any ways to export private keys.

You encrypt data (or rather you encrypt the symmetric keys to the data) using the public key, and you decrypt data (or rather you decrypt the symmetric keys to the data) via the API.

If the encrypted data has been stolen, and said person gains access to the project code, wouldn't this compromise the encrypted data regardless of HSM usage or self encryption?

No. They would still need access to the HSM hardware.

Because you use the HSM to encrypt data at rest, all they would have is encrypted data.

Of course, if they hacked into your network and spent some time sitting on a server they might find a way to sniff out the data when you are running your encrypt/decrypt processes. But then in that scenario, you're down to the old saying "with physical access, its Game Over in IT security".

Its all about layered security. The HSM is the core. You need to build additional security layers above it.

In the event of intrusion, how does HSM detect and alert?

HSM activity is fully auditable. Its up to you and your IDS and log monitoring systems to make use of that data !

The better commercial HSM devices also allow you to set stuff like rate limits on decryption to slow potential hackers down.

Upvotes: 2

Related Questions