What are hardware security modules (HSM), why we need them and how they work.

A Hardware Security Module (HSM) is a core part of the security posture of many organizations. It's a dedicated piece of hardware designed to create, host, manage and control keys and key material. They also help by performing all cryptographic operations on device .. allowing improved security and performance (via offloading). This video is the first in a security series which steps through HSMs and how they are used.
▶ Check out my full range of content at learn.cantrill.io
▶ Join the best online technical study community techstudyslack.com
FOLLOW ME 😺
▶ Twitter: / adriancantrill
▶ KZbin: / learncantrill
OTHER VIDEOS AND PLAYLISTS 🎞
▶ Network Fundamentals • Networking Fundamentals
▶ Technical Fundamentals • Technical Fundamentals
▶ AWS Fundamentals • AWS Fundamentals
▶ Course Intros • learn.cantrill.io - Co...
▶ Exam Question Practice • AWS Exam Question Walk...
▶ MINI PROJECT - Hybrid DNS • Mini Project - Hybrid ...
▶ MINI PROJECT - Advanced VPN • Mini-project - Advance...
▶ MINI PROJECT - Pet Cuddle O Tron • Mini-project - Pet-Cud...
▶ MINI PROJECT - Web Identity Federation • Mini-project - Simple ...
▶ MINI PROJECT - Architecture Evolution • Mini-project - Applica...
▶ MINI PROJECT - Cat Pipeline • Mini Project - CatPipe...
▶ Best Videos • Best Videos
All rights reserved © 2022 Adrian Cantrill

[@dmfh5646]

You're doing an amazing job of making difficult concepts easier to understand for those of us just starting off our cyber careers. Many thanks.

[@LearnCantrill]

Great to hear! Thanks for commenting.

[@wowgingermobile2123]

Again much appreciated your video! Just done my Security+ and I wish to learn so much more about HSM.

[@LearnCantrill]

Glad it was helpful!

[@gritred5500]

Great stuff explained very well!

[@ADAMSIVES]

Excellent video thanks!

[@micael1984]

It is what I'm looking for. Thank you

[@justinclayton42]

Very well presented, the perfect level of depth

[@LearnCantrill]

thanks, glad you like it :)

[@John-3692]

This is phenomenal. I had the privilege of reading something similar, and it was absolutely phenomenal. "Mastering AWS: A Software Engineers Guide" by Nathan Vale

[@sub4god]

Thank you, great work!

[@googlewalle8904]

Hi Adrian. Probably the best summary of how HSMs work from a high level. I currently perform staging/whitelisting of SQL Servers IP Addresses on nCipher RFS Servers. I understand the process pretty well, but, myself and other Engineers differ on how for instance, an nCipher HSM protects a SQL Server data encryption key (DEK). We are in meetings, and they all act like the SQL DEK is stored on the HSM. And my understanding in brief terms, goes like this: 1) SQL TDE DEK, is the key that encrypts the SQL Database file. 2) I stage the SQL Servers IP Addresses in both an HSM and RFS Config file (that the HSM will later call). 3) In order to integrate SQL Database Servers into nCipher HSM, they must first have the Entrust Security World software installed, and then the SQLEKM.dll I believe, via an Option Pack. 4) Once that's all setup, they will create some accounts, and an account that maps to the the SQLEKM.dll provider that's installed and setup on SQL Database. 5) ( THIS is where I need validation on how I think this truly works ): They will run some SQL queries to setup/create an Asymmetric Key, i.e. a call made to the SQLEKM Provider, which interfaces with the HSM. 6) The HSM Master key creates a KEK (Key Encryption Key) which is processed by the SQLEKM, and the KEK is used via the tdeLogin/tdeCredential while at the same time, being protected by the SQLEKM Provider in the Entrust (nShield or nCipher) HSM, to finally, encrypt the SQL TDE "DEK" or data encryption key, and hence, you have the HSM providing Key Management....Is my explanation somewhat close or am I off a bit? I really want to understand this process and be able to tell the guys at work, and per Entrusts documentation, that the TDEDEK Symmetric key is "created by the SQL Server and CANNOT be exported from the database, meaning it cannot be created or directly protected by the SQLEKM Provider (nShield or nCipher HSM). I'm hoping for a reply from you, and, am also hoping for more in-depth videos on Entrust (or other Vendor) HSMs and the in-depth ways the process truly works. Also interesting is it's use in PKI. That I would like to learn more as well. Thank you for your time!!

[@LearnCantrill]

Thanks for the comment. I’ll consider adding some focussed content on this.

[@reya4182]

Such a great explanation 👏👏👏 . There is no such series for this. It would be great if you could make one Azure Managed HSM and how to implement it using terraform

[@LearnCantrill]

Great suggestion!

[@user-mi2fp2wu1e]

thanks for the explanation!

[@LearnCantrill]

Glad it was helpful!

[@QueLastima]

This was exactly what I was looking for. Thanks.

[@LearnCantrill]

awesome :)

[@sachistic12]

Thanks for the easy explanation

[@LearnCantrill]

Glad it was helpful!

[@don156]

This is great, thank you very much

[@LearnCantrill]

You're very welcome!

[@owendcunha8906]

Hey Adrian I just wanted to let you know that you have added HSM Pictures in tech fundamentals learning aid in associate solution architect cource GitHub repository . I was a bit confused when I found it while going through the learning aids and instantly came here to know what HSM means

[@LearnCantrill]

Good result then ;)

[@itsredhwan]

Amazing explanation thanks a million! One thing here how we should integrate it with KMIP?

[@LearnCantrill]

thanks, glad you like it. KMIP is a little bit beyond the scope of this one, maybe another video :)

[@zebulongriggs4986]

Great video! Which playlist should I watch to continue the HSM learning?

[@LearnCantrill]

I don't really have (yet) any other more detailed videos on HSM

[@rohitshende934]

Lets say I want to store signing keys for the some tokens in HSM. Fist of all is this a good idea.? Second, if yes then does this not add latency to sign all tokens?

[@johnmartin5190]

So what are some vulnerabilities to having a HSM?

[@m.imraniqbaal6912]

Perfect 👍

[@LearnCantrill]

Thanks 👍

[@Rahul-lg1nw]

how to make a data vault on top of HSM for storing credentials??

[@LearnCantrill]

it depends which HSM, this video is a general concept video ... the HOW would be based entirely on what HSM you use.

[@mehulpruthi]

Does HSM store software keys?

[@LearnCantrill]

What do you mean by "software keys" ?

[@embeddedroom]

HeyCeSem :)

[@bille7585]

Raspberi Pi's ??

[@LearnCantrill]

? I don’t get what you’re asking.