Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How does your company manage its encryption keys?

news.ycombinator.com

Post reply on HN
Print view View original

61–70 of 246 posts

Re: Ask HN: How does your company manage its encryption keys?

#61

Post by toomuchtodo »

panpanna wrote: post #37
thieving_magpie wrote: post #14

Someone at my company generated the keys. They then put them on a network share without any security restrictions. They've been there for 5 years with no rotation. At least 2 are checked into source control.

If this is a public repo then you are already hacked. There are multiple automated systems that scan public repos for credentials. 5 minutes later you are mining bitcoins for them.

Github monitors for public commits of service secrets. Not an excuse to commit secrets, but there is a bit of a safety net.

> When you push to a public repository, GitHub scans the content of the commits for secrets. If you switch a private repository to public, GitHub scans the entire repository for secrets.

> When secret scanning detects a set of credentials, we notify the service provider who issued the secret. The service provider validates the credential and then decides whether they should revoke the secret, issue a new secret, or reach out to you directly, which will depend on the associated risks to you or the service provider.

https://help.github.com/en/github/administering-a-repository...

Re: Ask HN: How does your company manage its encryption keys?

#62

Post by 2mol »

hn_throwaway_99 wrote: post #42

I highly second the people saying KMS (AWS KMS, Google KMS, or KeyVault). * The pricing for just storing keys is incredibly cheap. * At least with Google KMS you can't delete the keys without a 24 hour waiting period (and you can alert on the deletion attempt), so that's a huge safeguard. * You get key access auditing out of the box.

Can you easily set up policies that prevent deletion of keys?

Re: Ask HN: How does your company manage its encryption keys?

#63

Post by ppierald »

thesimon wrote: post #16
toomuchtodo wrote: post #4

https://www.vaultproject.io/ We use Hashicorp's Vault product to manage SSH credentials, TLS certificates, as well as application secrets across thousands of users, tens of thousands of virtual machines, and hundreds of applications. We pay for the enterprise version, but the free version is more than capable for most needs. Avoid a password manager if you can, it leads to poor security practices and availability iss…

Especially convenient with KMS auto-unsealing ( https://learn.hashicorp.com/vault/operations/ops-autounseal-... )

The KMS autounseal is especially convenient, but you have to know that there is no silver bullet in crypto. You are trading off the convenience of the auto-unseal (and frankly, the fact that this can happen automatically in the middle of the night when your server reboots) against the security of your root unseal key itself.

The only thing protecting the unseal key is access to your KMS. So one rogue SRE can unseal the vault rather than requiring collusion of 1+ SRE members.

Again, this comes down to your risk tolerances and what you are protecting. I think for most workloads, the value KMS autounseal brings is worth the risk, but if you want to have tightest control, then the Shamir Split (M of N) is the best option.

Re: Ask HN: How does your company manage its encryption keys?

#64

Post by 2mol »

thieving_magpie wrote: post #14

Someone at my company generated the keys. They then put them on a network share without any security restrictions. They've been there for 5 years with no rotation. At least 2 are checked into source control.

This is an amazing answer, thank you for sharing :)

I wish you the energy to keep trying to change this, don't let it get to you too much, I know this stuff can be frustrating as hell.

Re: Ask HN: How does your company manage its encryption keys?

#65

Post by NovemberWhiskey »

dijit wrote: post #26
thesimon wrote: post #12

Vault for big stuff, git-crypt for file-level encryption of secrets (in Terraform files etc.)

What happens if vault gets destroyed or corrupted?

This is why you have geographically separated disaster recovery replicas and backups.

Re: Ask HN: How does your company manage its encryption keys?

#66

Post by parasec »

The more complex your system grows, the more often it will fail and shoot you in the foot. I'd advise against systems like Hashicorp Vault - they just increase the complexity and while they have their merits in complex setups, you seem to be too small to be able to operate such a system.

Have an offline backup printed along with the disaster recovery checklist and documentation and put them in a safe in your company - the checklist should be dumb enough that your drunk self can use it at four in the morning, because you were the nearest employee when everything went down.

Ensure that you have stupid manual processes in place on rotation of the safe's PIN and encryption keys in general, including a sanity check if the newly generated keys actually work (e.g. if they are used for your backup storage, actually back something up and restore it). Ensure that the safe's PIN is available to at least another person and used regularly (e.g. because you store your backup tapes there).

If you feel that you need to change from this very simple system to a more complex one, ask yourself why. What does your change actually add in terms of security and what risks does it add.

In the end, you want your system available to customers and the security you add is to not only secure the data, but actually to know who can access it (the auditing part).

Re: Ask HN: How does your company manage its encryption keys?

#69

Post by lormayna »

In my previous experience, I was working for an HSM and Data Protection vendor. If you want to be resonable secure to don't lose keys and keep them safe, just use an HSM. If you need to encrypt filesystem, you can use a DP product (most of them are not so expensive) If you want to database content, you can use tokenization services.
Post reply on HN