Cloud-based vs On-premises HSMs
Read Time: 08 min.
Encryption is one of the basic building blocks for any organization containing sensitive data/information. Sensitive data compliant with data privacy regulations creates a brand value for your organization as your organization becomes less prone to data breaches. As we all know the strength of the encryption depends upon two critical factors
- Key length
- Security of the Keys
Key length is quantifiable and could be determined using the various encryption algorithms such as AES-128 or AES-256. On the other hand, the Security of the key is a subjective matter. As we all know, the more secure the keys are, private keys in asymmetric and shared keys in symmetric encryption, the more powerful the encryption landscape is.
When it comes to the Security of Keys, the best bet is to use HSMs (Hardware Security Module) which are NIST compliant i.e. FIPS-140-2-Level3.
Cloud-based HSM vs. On-Premises HSM
In today’s article, we will compare Cloud-based HSM and On-prem HSM and try to
Find an answer for what criteria a customer should choose as the appropriate option for their organization’s crypto security.
On-prem HSMs are specifically useful for storing encryption keys when the organization wants complete control over their keys and policies without having any dependency on the Cloud Service Provider (CSPs). However, this comes at substantial upfront investment in terms of hardware, skilled resources, management software licenses managing the HSM cluster etc.
On the other hand, Cloud-based HSMs offer out-and-out advantages of the cloud in addition to conventional features of HSMs. To dig deeper, we can further classify the Cloud-based HSM into two categories: Public Cloud HSM Services and Third- Party HSM Services. Some Public Cloud HSM Services offer Single-tenant/dedicated or Multi-tenant services (e.g. AWS, Azure) whereas others offer only Multi-tenant services (e.g. GCP KMS, Oracle Key Vault) thus, these HSM Services are best suited for organizations which are dependent upon single Cloud Service Provider (CSP). In Third Party HSM Services, you can leverage multi-cloud platforms managed through the central management portal (e.g. DPoD) thus, these HSM Services are best suited for organizations with multi-cloud strategies. These HSM Services also offer use-case-based modular services to lessen data protection cost. Some examples of these services are Key Vault, Oracle TDE (Transparent Data Encryption), Code/Digital Signing etc.
Comparison at a Glance
| Cloud-based HSM | On-Premises HSM | |
|---|---|---|
| Hardware | No hardware required | # of hardware required including for resiliency, HA, Management Platform etc. |
| Payment Model | PAYG (pay-as-you-go) | Upfront Cost |
| Setup | Easy | Complex |
| Software | Included in the cost | Licenses may be required for each partition and Client Software |
| Client Deployment | Easy with CSP documentation | Complex and skill dependent |
| Compliance | Responsibility of CSP | Responsibility of the organization |
| Operational Overhead | Low as it’s a managed service from CSP | High as its managed by organization |
| SLA (Service Level Agreements) | Responsibility of CSP | Responsibility of organization |
| Operational Technical Knowledge | Medium with CSP’s documentation & vendor support | High as its managed by organization |
| Total Cost of Ownership | Low | High specifically for low # of partitions |
Conclusion
The HSM service is certainly a critical component while designing and deciding the data privacy measures for your organization’s PKI infrastructure. The decision between Cloud- based HSM or On-prem HSM is a function of TCO (total cost of ownership), number and complexity of the use cases, business, regulatory, legal compliances, foreseeable growth in the volume of the sensitive data, divergent data sources, and choice of business applications to name a few. Although Cloud-based HSM Services are becoming more popular considering the fact that more and more organizations are jumping to the cloud for its numerous benefits. However, On-prem HSMs become critical in the case when Cloud Service Provider (CSPs) hit some limitations, although they are very few in the count. To conclude, one thing remains consistently clear: the benefits offered by Public Key Infrastructure (PKI) can be completely undermined if private keys are compromised. Protecting and managing those keys is, therefore, a critical requirement to ensure enterprise data security. HSMs, whether On-prem or Cloud-based, are the best options today to fulfil that requirement.
