Cloud Key Management

Hi everyone,

As I had been reviewing our HSMaaS draft document, I thought of the following topic which may provide value to the IT auditing audience: "audit guidance on cloud HSM solutions/HSMaaS offerings" which of course may expand to include the KMS service offerings.

After our 2 publications (KM Lifecycle Best Practices & HSMaaS), a new,  separate document could follow, providing some brief guidelines on auditing these types of systems, focusing in critical areas, as required by the audit/certification schemes (cryptographic operations, user management/access-control, audit and immutable/signed logs, network isolation, key attestation).

It is a cloud service which is increasingly adopted and is part of audited environments under various audit schemes (PCI, WebTrust, eIDAS and ETSI TS 119 4xx standards) and I have personally faced it as an audit object while performing WebTrust, ISO 27017 and eIDAS audits. Additionally, it could also be bound to other CSA's areas such as CCAK or Cloud Security Guidance to reach audience who will benefit at the first level).

Thoughts are more than welcome (mentioning also @Michael Roza who is always having an unbiassed view :) )

Also, @Hannah Rock @Anna Schorr 

Best regards,

------------------------------
Thanos Vrachnos OffensiveOps | PKI & eID Subject-matter Expert
SPEARIT
Greece, Thessaloniki
------------------------------

Hi everyone,

As I had been reviewing our HSMaaS draft document, I thought of the following topic which may provide value to the IT auditing audience: "audit guidance on cloud HSM solutions/HSMaaS offerings" which of course may expand to include the KMS service offerings.

After our 2 publications (KM Lifecycle Best Practices & HSMaaS), a new,  separate document could follow, providing some brief guidelines on auditing these types of systems, focusing in critical areas, as required by the audit/certification schemes (cryptographic operations, user management/access-control, audit and immutable/signed logs, network isolation, key attestation).

It is a cloud service which is increasingly adopted and is part of audited environments under various audit schemes (PCI, WebTrust, eIDAS and ETSI TS 119 4xx standards) and I have personally faced it as an audit object while performing WebTrust, ISO 27017 and eIDAS audits. Additionally, it could also be bound to other CSA's areas such as CCAK or Cloud Security Guidance to reach audience who will benefit at the first level).

Thoughts are more than welcome (mentioning also @Michael Roza who is always having an unbiassed view :) )

Also, @Hannah Rock @Anna Schorr 

Best regards,

------------------------------
Thanos Vrachnos OffensiveOps | PKI & eID Subject-matter Expert
SPEARIT
Greece, Thessaloniki
------------------------------

Hi Thanos,

Sounds like an exciting topic to me. Thanks for sharing.

Best,

------------------------------
Anna Campbell Schorr
Training Program Manager
Cloud Security Alliance
[email protected]

Original Message:
Sent: May 12, 2023 08:16:54 AM
From: Thanos Vrachnos
Subject: HSMaaS Auditing Guidance

Hi everyone,

As I had been reviewing our HSMaaS draft document, I thought of the following topic which may provide value to the IT auditing audience: "audit guidance on cloud HSM solutions/HSMaaS offerings" which of course may expand to include the KMS service offerings.

After our 2 publications (KM Lifecycle Best Practices & HSMaaS), a new,  separate document could follow, providing some brief guidelines on auditing these types of systems, focusing in critical areas, as required by the audit/certification schemes (cryptographic operations, user management/access-control, audit and immutable/signed logs, network isolation, key attestation).

It is a cloud service which is increasingly adopted and is part of audited environments under various audit schemes (PCI, WebTrust, eIDAS and ETSI TS 119 4xx standards) and I have personally faced it as an audit object while performing WebTrust, ISO 27017 and eIDAS audits. Additionally, it could also be bound to other CSA's areas such as CCAK or Cloud Security Guidance to reach audience who will benefit at the first level).

Thoughts are more than welcome (mentioning also @Michael Roza who is always having an unbiassed view :) )

Also, @Hannah Rock @Anna Schorr 

Best regards,

------------------------------
Thanos Vrachnos OffensiveOps | PKI & eID Subject-matter Expert
SPEARIT
Greece, Thessaloniki
------------------------------

Thanks for the input @E A . Could you elaborate more on each option if possible? I think I will agree with you in general as far as I can understand your points. Would a feasibility "study", or a fit4purpose survey launched by CSA provide insights about the envisioned document? @Anna Schorr could you provide some high-level info regarding the CSA decision/purpose validation procedure (if available) on proposed guidance documents?

Kind regards

------------------------------
Thanos Vrachnos OffensiveOps | PKI & eID Subject-matter Expert
SPEARIT
Greece, Thessaloniki
------------------------------

Original Message:
Sent: May 16, 2023 02:44:35 PM
From: Anna Schorr
Subject: HSMaaS Auditing Guidance

Hi Thanos,

Sounds like an exciting topic to me. Thanks for sharing.

Best,

------------------------------
Anna Campbell Schorr
Training Program Manager
Cloud Security Alliance
[email protected]

Original Message:
Sent: May 12, 2023 08:16:54 AM
From: Thanos Vrachnos
Subject: HSMaaS Auditing Guidance

Hi everyone,

As I had been reviewing our HSMaaS draft document, I thought of the following topic which may provide value to the IT auditing audience: "audit guidance on cloud HSM solutions/HSMaaS offerings" which of course may expand to include the KMS service offerings.

After our 2 publications (KM Lifecycle Best Practices & HSMaaS), a new,  separate document could follow, providing some brief guidelines on auditing these types of systems, focusing in critical areas, as required by the audit/certification schemes (cryptographic operations, user management/access-control, audit and immutable/signed logs, network isolation, key attestation).

It is a cloud service which is increasingly adopted and is part of audited environments under various audit schemes (PCI, WebTrust, eIDAS and ETSI TS 119 4xx standards) and I have personally faced it as an audit object while performing WebTrust, ISO 27017 and eIDAS audits. Additionally, it could also be bound to other CSA's areas such as CCAK or Cloud Security Guidance to reach audience who will benefit at the first level).

Thoughts are more than welcome (mentioning also @Michael Roza who is always having an unbiassed view :) )

Also, @Hannah Rock @Anna Schorr 

Best regards,

------------------------------
Thanos Vrachnos OffensiveOps | PKI & eID Subject-matter Expert
SPEARIT
Greece, Thessaloniki
------------------------------

Thanks for the input @E A . Could you elaborate more on each option if possible? I think I will agree with you in general as far as I can understand your points. Would a feasibility "study", or a fit4purpose survey launched by CSA provide insights about the envisioned document? @Anna Schorr could you provide some high-level info regarding the CSA decision/purpose validation procedure (if available) on proposed guidance documents?

Kind regards

------------------------------
Thanos Vrachnos OffensiveOps | PKI & eID Subject-matter Expert
SPEARIT
Greece, Thessaloniki

Original Message:
Sent: May 16, 2023 02:44:35 PM
From: Anna Schorr
Subject: HSMaaS Auditing Guidance

Hi Thanos,

Sounds like an exciting topic to me. Thanks for sharing.

Best,

------------------------------
Anna Campbell Schorr
Training Program Manager
Cloud Security Alliance
[email protected]

Original Message:
Sent: May 12, 2023 08:16:54 AM
From: Thanos Vrachnos
Subject: HSMaaS Auditing Guidance

Hi everyone,

As I had been reviewing our HSMaaS draft document, I thought of the following topic which may provide value to the IT auditing audience: "audit guidance on cloud HSM solutions/HSMaaS offerings" which of course may expand to include the KMS service offerings.

After our 2 publications (KM Lifecycle Best Practices & HSMaaS), a new,  separate document could follow, providing some brief guidelines on auditing these types of systems, focusing in critical areas, as required by the audit/certification schemes (cryptographic operations, user management/access-control, audit and immutable/signed logs, network isolation, key attestation).

It is a cloud service which is increasingly adopted and is part of audited environments under various audit schemes (PCI, WebTrust, eIDAS and ETSI TS 119 4xx standards) and I have personally faced it as an audit object while performing WebTrust, ISO 27017 and eIDAS audits. Additionally, it could also be bound to other CSA's areas such as CCAK or Cloud Security Guidance to reach audience who will benefit at the first level).

Thoughts are more than welcome (mentioning also @Michael Roza who is always having an unbiassed view :) )

Also, @Hannah Rock @Anna Schorr 

Best regards,

------------------------------
Thanos Vrachnos OffensiveOps | PKI & eID Subject-matter Expert
SPEARIT
Greece, Thessaloniki
------------------------------

Hi everyone,

As I had been reviewing our HSMaaS draft document, I thought of the following topic which may provide value to the IT auditing audience: "audit guidance on cloud HSM solutions/HSMaaS offerings" which of course may expand to include the KMS service offerings.

After our 2 publications (KM Lifecycle Best Practices & HSMaaS), a new,  separate document could follow, providing some brief guidelines on auditing these types of systems, focusing in critical areas, as required by the audit/certification schemes (cryptographic operations, user management/access-control, audit and immutable/signed logs, network isolation, key attestation).

It is a cloud service which is increasingly adopted and is part of audited environments under various audit schemes (PCI, WebTrust, eIDAS and ETSI TS 119 4xx standards) and I have personally faced it as an audit object while performing WebTrust, ISO 27017 and eIDAS audits. Additionally, it could also be bound to other CSA's areas such as CCAK or Cloud Security Guidance to reach audience who will benefit at the first level).

Thoughts are more than welcome (mentioning also @Michael Roza who is always having an unbiassed view :) )

Also, @Hannah Rock @Anna Schorr 

Best regards,

------------------------------
Thanos Vrachnos OffensiveOps | PKI & eID Subject-matter Expert
SPEARIT
Greece, Thessaloniki
------------------------------

Good idea. I like it.

One of the top 3 causes of a breach is misconfiguration. Audits catch those kinds of errors. Might as well help them do an audit right.

Hi everyone,

As I had been reviewing our HSMaaS draft document, I thought of the following topic which may provide value to the IT auditing audience: "audit guidance on cloud HSM solutions/HSMaaS offerings" which of course may expand to include the KMS service offerings.

After our 2 publications (KM Lifecycle Best Practices & HSMaaS), a new,  separate document could follow, providing some brief guidelines on auditing these types of systems, focusing in critical areas, as required by the audit/certification schemes (cryptographic operations, user management/access-control, audit and immutable/signed logs, network isolation, key attestation).

It is a cloud service which is increasingly adopted and is part of audited environments under various audit schemes (PCI, WebTrust, eIDAS and ETSI TS 119 4xx standards) and I have personally faced it as an audit object while performing WebTrust, ISO 27017 and eIDAS audits. Additionally, it could also be bound to other CSA's areas such as CCAK or Cloud Security Guidance to reach audience who will benefit at the first level).

Thoughts are more than welcome (mentioning also @Michael Roza who is always having an unbiassed view :) )

Also, @Hannah Rock @Anna Schorr 

Best regards,

------------------------------
Thanos Vrachnos OffensiveOps | PKI & eID Subject-matter Expert
SPEARIT
Greece, Thessaloniki
------------------------------

Good idea. I like it.

One of the top 3 causes of a breach is misconfiguration. Audits catch those kinds of errors. Might as well help them do an audit right.

Hi everyone,

As I had been reviewing our HSMaaS draft document, I thought of the following topic which may provide value to the IT auditing audience: "audit guidance on cloud HSM solutions/HSMaaS offerings" which of course may expand to include the KMS service offerings.

After our 2 publications (KM Lifecycle Best Practices & HSMaaS), a new,  separate document could follow, providing some brief guidelines on auditing these types of systems, focusing in critical areas, as required by the audit/certification schemes (cryptographic operations, user management/access-control, audit and immutable/signed logs, network isolation, key attestation).

It is a cloud service which is increasingly adopted and is part of audited environments under various audit schemes (PCI, WebTrust, eIDAS and ETSI TS 119 4xx standards) and I have personally faced it as an audit object while performing WebTrust, ISO 27017 and eIDAS audits. Additionally, it could also be bound to other CSA's areas such as CCAK or Cloud Security Guidance to reach audience who will benefit at the first level).

Thoughts are more than welcome (mentioning also @Michael Roza who is always having an unbiassed view :) )

Also, @Hannah Rock @Anna Schorr 

Best regards,

------------------------------
Thanos Vrachnos OffensiveOps | PKI & eID Subject-matter Expert
SPEARIT
Greece, Thessaloniki
------------------------------

Coming from an auditing and certification place here, also CSA's CCAK structure is made for auditors, I would not worry about that aspect.

The idea is to provide a "2D" guidance, not only in internal audits as @Alex Sharpe mentioned but also in external, 3rd party audits as mentioned in my first message. Any of the popular standards which include/foresee requirements for HSMs: PCI, WebTrust for CA, eIDAS - ETSI TS 119 4xx standards,  ISO 27017, etc. Also, CCAK's body of knowledge could include such a chapter in a next release.

But regarding the certification schemes, it should be examined whether HSMaaS is allowed as an option currently (in several of the above, it is not). One of the objectives of the upcoming HSMaaS paper is to provide awareness on this topic so that this technology option can be considered in future certification/audit scheme releases.

Good idea. I like it.

One of the top 3 causes of a breach is misconfiguration. Audits catch those kinds of errors. Might as well help them do an audit right.

Hi everyone,

As I had been reviewing our HSMaaS draft document, I thought of the following topic which may provide value to the IT auditing audience: "audit guidance on cloud HSM solutions/HSMaaS offerings" which of course may expand to include the KMS service offerings.

After our 2 publications (KM Lifecycle Best Practices & HSMaaS), a new,  separate document could follow, providing some brief guidelines on auditing these types of systems, focusing in critical areas, as required by the audit/certification schemes (cryptographic operations, user management/access-control, audit and immutable/signed logs, network isolation, key attestation).

It is a cloud service which is increasingly adopted and is part of audited environments under various audit schemes (PCI, WebTrust, eIDAS and ETSI TS 119 4xx standards) and I have personally faced it as an audit object while performing WebTrust, ISO 27017 and eIDAS audits. Additionally, it could also be bound to other CSA's areas such as CCAK or Cloud Security Guidance to reach audience who will benefit at the first level).

Thoughts are more than welcome (mentioning also @Michael Roza who is always having an unbiassed view :) )

Also, @Hannah Rock @Anna Schorr 

Best regards,

------------------------------
Thanos Vrachnos OffensiveOps | PKI & eID Subject-matter Expert
SPEARIT
Greece, Thessaloniki
------------------------------

I think that the HSMaaS paper will generate a new artifact: recommended updates to CCM for HSM as a Service. 

So in my opinion, there is no need for a separate, auditing guideline document. HSMaaS can be auditing under its dedicated section of the CCM. Besides, I've not seen other dedicated audit guideline documents published by CSA.

@Marina Bregkou how is this CCM-HSMaaS updates going to be triggered/handled? (see p.58 of our HSMaaS paper)

Coming from an auditing and certification place here, also CSA's CCAK structure is made for auditors, I would not worry about that aspect.

The idea is to provide a "2D" guidance, not only in internal audits as @Alex Sharpe mentioned but also in external, 3rd party audits as mentioned in my first message. Any of the popular standards which include/foresee requirements for HSMs: PCI, WebTrust for CA, eIDAS - ETSI TS 119 4xx standards,  ISO 27017, etc. Also, CCAK's body of knowledge could include such a chapter in a next release.

But regarding the certification schemes, it should be examined whether HSMaaS is allowed as an option currently (in several of the above, it is not). One of the objectives of the upcoming HSMaaS paper is to provide awareness on this topic so that this technology option can be considered in future certification/audit scheme releases.

Good idea. I like it.

One of the top 3 causes of a breach is misconfiguration. Audits catch those kinds of errors. Might as well help them do an audit right.

Hi everyone,

As I had been reviewing our HSMaaS draft document, I thought of the following topic which may provide value to the IT auditing audience: "audit guidance on cloud HSM solutions/HSMaaS offerings" which of course may expand to include the KMS service offerings.

After our 2 publications (KM Lifecycle Best Practices & HSMaaS), a new,  separate document could follow, providing some brief guidelines on auditing these types of systems, focusing in critical areas, as required by the audit/certification schemes (cryptographic operations, user management/access-control, audit and immutable/signed logs, network isolation, key attestation).

It is a cloud service which is increasingly adopted and is part of audited environments under various audit schemes (PCI, WebTrust, eIDAS and ETSI TS 119 4xx standards) and I have personally faced it as an audit object while performing WebTrust, ISO 27017 and eIDAS audits. Additionally, it could also be bound to other CSA's areas such as CCAK or Cloud Security Guidance to reach audience who will benefit at the first level).

Thoughts are more than welcome (mentioning also @Michael Roza who is always having an unbiassed view :) )

Also, @Hannah Rock @Anna Schorr 

Best regards,

------------------------------
Thanos Vrachnos OffensiveOps | PKI & eID Subject-matter Expert
SPEARIT
Greece, Thessaloniki
------------------------------