@schroeder doesnt mean it wont work in your specific situation, just some aspects to think about.

btw, if phrased thusly, it could be a good question.

exactly. Security monkeys.

@AviD Grist for the mill was what I needed. Thank you.

@schroeder oh another thing, that the high end HSMs sort out for you - how do you protect access?

i.e. does the application need to store a password to access it?

@AviD yeah, I thought of that

if so, how is it protected? encrypted with what?

I see that as part of the architectural aspects.

so, 3 areas.

right

@AviD in 1:4:9 aspect ratio

sorry, 4:9:36

I dont get it

maybe too tired

it's the monolith measurements

funny where searching for 4:9:36 (surface areas) gets you: prabhupadabooks.com/sb/4/9/36

@AviD Unfortunately, coffee and poop are inextricably linked, I fear.

> In the Bhagavad-gītā the Lord says that He is the supreme enjoyer, the supreme proprietor of everything and anything within this creation, and the supreme friend of everyone. When one knows these things perfectly, he is always satisfied. The pure devotee never hankers after any kind of material prosperity.

Sounds like @AviD's guide to modship

@TildalWave ohhh of course, mea culpa

@TildalWave I wouldnt be surprised if that exactly is the reason those numbers were selected.

@AviD gets even odder if you read the 1/4/9 one prabhupadabooks.com/sb/1/4/9

> So everything about him is wonderful, and his activities are worth hearing attentively. Desire is expressed herein to hear about him in detail.

or

> His activities are also wonderful because he chastised Kali, who was attempting to kill a cow.

@schroeder The primary value of a HSM is that the cryptographic keys doesn't leave the device. Which makes it that much harder to compromise.

You don't get that with a password manager.

@TerryChia I hear you, and I agree, but I guess me question (that I have to defend) is "what is the difference between a HSM and a Key Management System?"

We have a requirement to use a "Key Management System"

HSM would be awesome (I'm suggesting it), but management is rejecting it

"can we implement a Key Management System without going so far as an HSM?"

spam?

yep

it looks like they hired a new marketer this week

(form their site)

so my question might boil down to: what are the bare minimum requirements for something to be an effective Key Management System?

@schroeder https://en.wikipedia.org/wiki/Key_management#Challenges_of_Key_Management

:)

lol

onebox ruined it

I think the Governance problem is the major issue

I think an encrypted password manager might fit as a tool to solve most of the issues, but governance would be hell

it's not really surprising that there's many similarities between key management and multitenant password managers is there?

@schroeder As with all things security: "what's your threat model?"

@TerryChia lol - contractual agreements and a limited budget .... :D

@TerryChia that IS the question, of course

the TOC of section 6 of the NIST publication pretty much defines a quick list of what a KMS needs to do: nvlpubs.nist.gov/nistpubs/SpecialPublications/…

If nothing else, I can say that when a customer expects us to use a KMS, the NIST definition is a guide to what that means.