Download as PDF, PPTX
Uploaded byWSO2
WSO2 Guest Webinar: WSO2 Identity Server: Adding Hardware Security Module Without Breaking the Bank
The document presents a webinar on integrating hardware security modules (HSM) with WSO2 Identity Server, highlighting the benefits of increased security without significant financial burden. It introduces speakers from Yubico and Yenlo, discusses various security aspects, and compares costs of different HSM vendors, emphasizing Yubico's affordability. Key takeaways include the advantages of using HSMs for secure cryptographic processing, illustrating their use cases in various industries such as government and healthcare.
![[Roundtable] Choreo - The AI-Native Internal Developer Platform as a Service](https://cdn.slidesharecdn.com/ss_thumbnails/choreo-deck-250328074645-511dded7-thumbnail.jpg?width=640&height=640&fit=bounds)
WSO2 Guest Webinar: WSO2 Identity Server: Adding Hardware Security Module Without Breaking the Bank
- 1.
- 2.
- 3. 3 • Premier Partner of WSO2 • Global Organiza0on • Offices in the Netherlands, Germany, Belgium, United Kingdom and United States • Experts is Integra0on Solu0ons • Experts in a ‘Connected Business’ • WSO2 project & consultancy services • WSO2 support services: • Product Support • Development Support • Opera0onal Support • WSO2 Training services • Enterprise & Solu0on Architecture Who we are What we deliver More info about us and our pre-build (WSO2) solu0ons: www.yenlo.com
- 4. Topics Webinar 4 WSO2 Iden0ty Server: Adding Hardware Security Module Without Breaking the Bank • Introduc0on to Security • Yubico HSM • WSO2 Iden0ty Server • Benefits & Technical details • You have ques0ons? We have answers!
- 5.
- 6. Depending on the chain o Human factor (weakest link?) ① o Frontend (encryp0on) ② o Transport (encryp0on) ③ o Backend (so<ware, encryp0on, firewalls) ④ Security has many faces 6
- 7.
- 8. o Depends on what needs to be secured (access to website vs. health data) o Depends on what is offered (UID & Password, 2 factor authen0ca0on) o Depends on the usability (forcing ‘$yh*7EP9$’ passwords) o Depends on the acceptance of risk (creditcard and signature) Security is a subjec0ve topic 7 Public Domain, https://en.wikipedia.org/w/index.php?curid=2308226 Top Secret Secret Confidential Public Trust Unclassified
- 9.
- 10.
- 11. o WSO2 is an open source product, sources are publicly available o WSO2 uses many Apache projects internally (Axis, Synapse etc.) o WSO2 is an open system that can be extended by means of custom developed modules, mediators and so on as well as through connectors to third party systems o WSO2 products do not require any addi0onal hardware to run Can something that is this open, be secure? Is ‘secure open source’ an oxymoron? How secure are WSO2 products? 9
- 12. Why do we need an HSM? Doesn’t WSO2 do the trick? Yes, for many organiza0ons WSO2 offers ample security. But Hardware Security Module offer: o Beger random genera0on o Calcula0ons done in hardware rather than so<ware o Keys stored more securely Use cases: o Government o Banking / insurance o Healthcare o Any organiza0on that values security
- 13.
- 14. CORE FEATURES o Works with any standard USB port, across mul0ple opera0ng systems including Linux and Microso< Windows. o Offers encryp0on with a Message Authen0ca0on Code (MAC), HMAC-SHA1 hashing, AES encryp0on/decryp0on, and cryptographic True Random Number Genera0on. o Provides a physically isolated environment for cryptographic processing. o Has no moving parts and requires no addi0onal maintenance once installed. o Capable of suppor0ng any counter-based OTP protocol including YubiOTP (Yubico’s OTP implementa0on) and OATH- HOTP authen0ca0on. 13
- 15.
- 16. o WSO2 Iden0ty server is a leading IAM product o Works without addi0onal hardware o Open Source o Highly performant o Used by all kinds of organiza0ons (from SME to large corporate) o Current version 5.1.0 o Extendable with IS-connectors and well defined extension points. WSO2 Iden0ty Server 21
- 17. User management in Iden0ty server 28 User Store Manager JDBCLDAP AD Custom User Store
- 18.
- 19. HSM for Iden0ty server o Crea0ng a custom user store manager protected StringpreparePassword(String password, String saltValue) throws UserStoreException { int keyHandle = 12337; // The key to use in the YubiHSM (0x3031) // Instance of YubiHSM YubiHSM hsm = new YubiHSM(); // Generate HmacSHA1 for password String newPassword = hsm.generateHMACSHA1(password, keyHandle, true, false).get("hash"); return newPassword; } 28
- 20.
- 21.
- 22. Benefits are clear o Improved security o Physical based genera0on of random numbers o TPM-like iden0ty assurance, not 0ed to a server o Secure, isolated cryptographic processor o Extending the deployability of IS in high-security environments o And of course, without breaking the bank! 30
- 23. Without breaking the bank # of HSMs Connec0on Type One 0me cost Recurring cost Total Vendor X 2 USB $ 8.900 $ 4.000 $ 12.900 Vendor Y 2 PCI-E $ 18.000 $ 4.000 $ 22.000 Vendor Z 2 Network Agached Appliance $ 32.400 $ 2.200 $ 34.600 Yubico 2 USB $ 1000 - $ 1000
- 24.
- 25.
- 26.