4 ms·
I wonder how many sub $100million non-security-focussed companies A) Properly use an HSM at the root of their PKI. (Following all the procedures for s
by ghshephard 14y ago
I wonder how many sub $100million non-security-focussed companies
A) Properly use an HSM at the root of their PKI. (Following
all the procedures for sharding their XofY control of the device)
B) Have " corporate standards for a build server"
C) Routinely audit their build servers to ensure they adhere
to those corporate standards.
At least the HSM limited the damage to the compromised servers and, of course, all the code that got signed in the interim.
- gsibble 14y agoMost small companies cannot afford to invest the time into this kind of thing (obviously).
- ximeng 14y agoB and C could be something as similar as having a VM with a standard set of build tools and checking nothing else has been added, which should be in reach of even small companies.
- alexchamberlain 14y agoPerhaps storing a hash of the VM's hard disk?