Heidi.
And welcome back.
Now, in today's video, we will be discussing about the cloud.
It is in service.
Now, before we look into it in more detail, let's take a very simple use case of storing expensive
household items.
So let's say that you have some expensive jewelry that is generally stored in your house, but now you're
planning for a long vacation.
After completing various security compliances for your organization.
So now you're going for a long vacation and you have expensive jewelry at your house.
Now, where will you prefer to store your jewelry?
Will you store it in the cupboard, which is in your house?
Or maybe you'll prefer a bank locker which is much more secure.
And the answer is definitely you will store it in the bank locker and not just any bank locker.
You will also do research into which banks are more reputed and also which banks are in much more secure
area in your city.
And you should store your jewelry in that bank locker.
Now, this really makes sense and it is easy to understand, but what happens when we discuss about
storing sensitive digital keys so you can have very sensitive keys within your organization encryption
keys, SSL dials, keys, etc. that needs to be stored now very well.
You prefer to store those keys into value stored those keys in no time.
Or maybe will you store those keys in some special security devices which are meant for storing sensitive
data.
And the answer is yes, we will be proffering those special security devices.
Audio Habit.
Look, the answer is simple, but in a lot of organizations that you will see, the keys are actually
stored in Notepad or maybe some Gmail based e-mails or maybe in Slack messages.
They are not really stored in secure devices, primarily because you need to configure them as often
and hence the users prefer to store them in tools like notepad, like etc. However, when you go towards
the organizations that are much more security oriented, and even for the organizations that are following
some kind of a security specific compliances, there is a requirement to wear the sensitive encryption
keys or digital keys must be stored in a special security devices, otherwise they will not clear to
you for the compliance itself.
And hence, it is important for us to note a high level overview about these special security devices
as well.
Now, these special security devices that we were discussing are also referred to as a hardware security
module, which is HSM saw.
HSM is basically a physical device that provides extra security for their sensitive data.
Now, this type of devices is generally used to provision cryptographic keys for critical functions
such as encryption, decryption and authentication for use of application identities and databases.
At a high level overview, it is used to protect this sensitive data.
Now these devices have some added features on top of it.
One of them is tamper resisting.
So for example, if anyone tries to tamper with the devices, the guys that are stored will automatically
be deleted.
The primary aim is secure storage of your very sensitive data for the organizations here.
Great.
Now one of the challenges that you'll will generally see is that organizations are now migrating to
cloud.
And let's say that they have these physical devices in the on premise location along with their servers,
and after a few months they're migrating to cloud.
Now, how will they really move these sensitive devices like HCM to cloud?
It is not really feasible and not really possible as well.
So migration of the physical devices is not possible.
So what they will do, they will have a connectivity between On-Premise and cloud that the applications
that are running in place will connect to the hardware security module, which is running in the on
premise location.
And the transfer happens, but it comes with various disadvantages related to the network.
In case if the network is slow, then the application will also stall accordingly.
So in order to overcome this, it has also introduced a service as Cloud HSM.
A cloud HSM is basically a cloud based hardware security module.
So in case if you're migrating to cloud, you no longer have to worry about the physical device being
present in it.
On premise location, you can simply make use of the cloud HSM service and it will work perfectly well.
So if you look into this diagram, you have a cloud adjacent service and you have various application
that are available in, say, WPC and application can basically connect to the cloud.
It is in service for various operations easily already.
So this glorious system that we see allows you to manage your own encryption keys using FIPS 142 Level
three.
It is and so it is not some random it seems that IWC uses.
There needs to be a standard of HSM which is very secure and compliant.
So you need to also remember this what exempt?
Sometimes they ask the FIPS 142 level three validated a system.
So just remember this at a high level or what have you.
Now before we conclude, let me quickly show you on how exactly this looks like.
So generally in the IWC console, if you will look for the ecosystem, you have the cloud HSM over here
and within this service you can go ahead and easily create your cloud.
It is then cluster and when creating the cluster you see you also have to basically define the VPC as
well as the availability zones based on which the cluster configuration would really take place.
So this is the high level overview about basics of what the hardware security modules and also some
of the advantages of cloud HSM service in aid of this.