Web servers are pervasive and integral part of the internet. To establish a secure connection with the web server (TLS), the web server has a private key and certificate. However, these secrets are often stored unsecured on the web server itself. Attackers can gain access to the TLS private key of the web server, impersonate the web server, and subsequently steal user credentials and other data.
The best way to secure the private key is to store it in an HSM and reach out to the HSM every time a session needs to be established to perform the crypto operations during the handshake. However, with Traditional HSMs this results in significantly impaired performance. Traditional network attached HSMs add latency, provide limited bandwidth, and do not scale well.
Fortanix Self-Defending KMS, built with a scale-out distributed architecture, can serve any cloud environment without trade-offs between security, simplicity and scalability. Fortanix Self-Defending KMS is designed to provide low latency and high throughput. It can be deployed in proximity to the webservers, yet managed centrally.