1

For our project we are using a 3rd party application (installed on their cloud). For crypto purposes, this application requires to access the HSM that is located in our LAN.

So in terms of security I was wondering:

  1. What risks we would take if the HSM would be accessible through the internet via VPN (considering that all enc/dec are done by HSM)?
  2. Whether this configuration would work? <Internet><FW><Reverse Proxy><FW><HSM><FW><LAN>

Thanks in advance for your help

sgres
  • 129
  • 2
  • 8
  • 1
    I'd mostly be worried about what the third party application could do with the HSM access, or whether the third party application could be used by an attacker as an attack vector against the HSM (e.g. denial of service, causing other issues). – Matthew Sep 27 '18 at 09:57

1 Answers1

3

A VPN over the internet is secure if it's set up properly, plus any connections to the HSM should be encrypted as well. The big concern I would have is that you are letting an external organization into your network. Third parties are out of your control, if they were hacked then an attacker could attempt to penetrate your organization through that connection. To mitigate this risk you'd want to put your HSMs in a separate DMZ and only allow traffic to those HSMs from that VPN. A penetration test of the HSMs would also be a good idea to make sure they are configured properly, you don't want them leaking information.

GdD
  • 17,291
  • 2
  • 41
  • 63