Dramatically reduce the significant cost of Hardware Security Module (HSM) ownership through

• – Reduced cost of maintaining an HSM security team (a skilled and scarce resource)
• – Building and maintaining a resilient HSM infrastructure with redundancy
• – Offloaded Key ceremonies for generation, rotation and exchange with schemes
• – Keeping Software up to date
• – Supporting Policies and Procedures
• – Maintaining a Security Operations Centre
• – Meeting and maintaining PCI standard audit

The cost of the above, along with ongoing mandatory vendor maintenance contracts, adds significant ownership cost for any business.

On-Premise Security or Data Centre Costs

Physically housing a HSM estate is, for any business, a large logistical undertaking. With the physical security of your devices a key factor in compliance audits, the costs and understanding of requirements can often leave businesses exposed.

Zero Touch Solution

Reduce all costs whether monetary, time, labour or otherwise associated with the HSM service setup and configuration required with regulated HSM usage.

A single monthly  service subscription provides all the relevant HSM  processing, service and regulatory support needs.

Compliance Scope Reduction

We help our clients with solutions to regulatory issues.

We can provide you with bespoke consultancy in adhering to PCI Standards including:

• – PCI DSS
• – PCI P2PE
• – PCI PIN

We work closely with our clients and their QSA Company to ensure that clients take appropriate measures to maintain compliance with PCI DSS.

We can also assist our clients with meeting the requirements of P2PE and ensuring a smooth process to achieving certification for their solutions including.

ID-3 documentation services can assist you with the following:

• – Explaining the HSM service relevant details of the system
• – Support development of high and low level design documents
• – Interface with relevant stake holders and service providers to ensure the right information for the service requirement is obtained and detailed
• – Design and implement the relevant key and card separation, safe access controls and logs to support the right degree of assurance
• – Assist in the provision of time and cost estimates for a service requirement
• – Detail the relations between various modules and functions of the system
• – Provide the relevant information to ensure the stake holders understand the solutions architecture being proposed

Internal Risk Management Audit Services

Each time a Hardware Security Module (HSM) is placed into service

Whether new or through exchange a commissioning process, which is the process of establishing your organisational cryptographic secrets on to the device needs to be undertaken. This procedure is known as a Key Ceremony and has to be conducted with experience to be demonstrable in order to form the core of trust within your security platform and to satisfy the regulatory requirements.

The Key Ceremony is performed by custodians who typically have very little time and expect to be guided through the process, which should demonstrate both organisation and security. In many cases explanation of the activities and hand held guidance are also required too.

At the end of the process you need to know that you have not only successfully carried out the technical requirement of generating or loading the Master Key but also captured the relevant details to prove performance and to have the relevant signatories present to complete the formalities required for attestation.

Failure to give this process the due care and attention it deserves will almost certainly mean a costly re-run at some other stage after the project’s go live date.

A successful Key Ceremony requires expertise, documentation and planning – anything less is a waste of time and will leave you exposed.

ID-3 has proven experience in providing Key Ceremonies and knows exactly what it takes to assist you through yours.

Commonly businesses fail to capture the relevant detail to make the following essentials demonstrable:

• – Adherence to the chain of custody
• – Evidencing that the device has not been tampered with
• – Enforcing the right degree of dual control and separation of duties are in place before the device is commissioned
• – Ensuring that the attack surface has been reduced
• – Ensuring the access control logs are fit for compliance
• – Evidencing that remote management has securely been deployed to suit your strategy for reduced data centre presence

Making procedural activities demonstrable can be a difficult thing to achieve when you only perform these operations on rare occasions, yet getting them wrong can have severe consequences for your organisation.

Consequences include financial penalty and in the worst case restricted network access, which could lead to the inability to process. Compound the problem with the fact that the business could be production processing on a compromised device and significant organisational pain could be realised.