I am working with a security person that baffles me a bit with the practices he

Question

I am working with a security person that baffles me a bit with the practices he performs. Besides the issue of this person insisting on bypassing every security measure in place we have got into it about handling private keys and certificates.

So this is my perspective of best practices in regards to web servers: When generating private keys it is best to generate them where they will be used and never move them to any other system, if at all possible. From this point generate a CSR from the server with it, to get a signed certificate. At this point the private key is never exposed to anything but the server that originally generated it, therefore there is no chance a hacked laptop or share might expose it.

This makes sense to me, however this security person seems to prefer generating the private key on a system he controls, then transfer this to whatever system needs it. This seems to extend the risk by having the private key in more then one spot as well as a lot more work with no benefit that I can see.

Am I missing anything with this? Other than common practice, is there a reason I am not seeing for this to be done?

Explanation / Answer

As long as the machine in question has enough entropy to generate strongly random keys and nonces, that's totally correct. The key must never leave that server. Even more, if I were working on a critical application, I wouldn't even trust that machine and keep the key in a HSM. It might cost a lost, but it significantly enhances the security.

There is a broad spectrum of security practices, going from the best case above, to the worst possible situation, which appears to be your case. Either your colleague has a specific reason for doing so or he/she is putting the security of your applications at risk. Immediately confront him/her. If I were in charge, I would fire that "security" person at once.

Related Questions

Navigate

• Browse (All)
• Browse I
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.