Take this scenario as an example: An organization has a few build servers that periodically check out source from a repository and builds everything. When a build finishes the binaries are code signed and archived and sometimes posted to the public along with the signatures and public certificate.
Assuming that:
- The private EV cert is stored on a hardware token connected to the signing server, presumably in a physically secure environment (code signing environment).
- the server would likely be Linux based.
What precautions are appropriate for such a signing server, HSM or otherwise.
- Should the signing environment be located behind a locked door accessible only with an id badge.
- Could denying simple physical accessibility be enough (place the signing environment in a ventilated and physically secure box?
- What are the considerations for how physically secure the environment should be?
- Would a locked server room sufficiently secure?
- When is it unsound to have a code signing server connected to the company network? (To provide access to build servers)
- Is key based ssh sessions enough to secure communications between build servers and the signing server over the company network?
Thanks!