Security Guidance

Your nShield HSM protects the confidentiality and integrity of your Security World keys. Keysafe 5 allows an authorized client to remotely configure and manage an estate of nShield HSMs. All network traffic between Keysafe 5 and clients using the UI, the REST API, or both, passes through a secure channel. This TLS based secure channel is set up using token-based client authentication. The administrator of the Keysafe 5 system must remain diligent concerning the entities who are given access to the system and the secure configuration of the system.

Entrust recommends the following security-related actions for Keysafe 5 deployments:

  • Ensure that log levels are set appropriately for your environment.

    More verbose log levels might expose information that is useful for auditing users of Keysafe 5, but the log information also reveals which REST API operations were performed. While this log information might be useful for diagnostics, it could also be considered sensitive and should be suitably protected when stored.

  • Rotate the logs regularly. The log files could grow quickly if left unattended for a long time. The system administrator is responsible for log rotation.

  • Verify the integrity of the Keysafe 5 tar file before executing it. You can verify the integrity of this file with the hash provided with the software download.

  • Suitably protect the network environment of Keysafe 5 to maintain its availability, for example using firewalls and intrusion detection and prevention systems.

  • Ensure that the Keysafe 5 platform’s system clock is set accurately and only authorized system administrators can modify it so that the platform correctly interprets certificate and token lifetimes.

  • Ensure that only authorized system administrators have access to the Keysafe 5 system, and only trusted software is run on the platform hosting Keysafe 5.

  • Take standard virus prevention and detection measures on the platform hosting Keysafe 5.

  • The system administrator should consider whether threats in the Keysafe 5 deployment environment would justify the encryption of the sensitive configuration data held in Kubernetes secrets, see Kubernetes documentation.