3 ms·
The cloud providers provide the access controls for the HSM. Why break the encryption when you can just come through the front door?
by james_in_the_uk 8y ago
The cloud providers provide the access controls for the HSM. Why break the encryption when you can just come through the front door?
- close04 8y agoThat's not how HSMs work or they would be totally useless. Short of a hidden vulnerability or a manufacturing defect there's no "official" way to physically access data from the device without destroying it. And accessing the data the normal way still requires access the cloud provider doesn't have (a certificate password for example). If we're talking hackers that could successfully hack an HSM, they don't really care about laws. And if we're talking about acting under some law, that law has to compel the owner of the password to give it up. Not the cloud provider.
- Foxboron 8y agoSo your threat model includes the cloud provider?