how does big companies like google, amazon, manage their private key infrastructure?

Question

one of my company's employees private key was compromised and it had the disastrous consequences to the company. now the company is planning to have the public/ private key management. Im wondering how the big companies like google, amazon do the key management. do they use third party application for centralization? or they do it with the set of PKI policy to be implemented in the organization. how they manages the key life-cycle?

thanks for your time.

Answer 1

I believe they do it in very different ways, but there are many solutions for this. For the AWS perspective, i'd suggest you take a look at AWS Cloud HSM, a hardware security module provisioned as a service for secure key management: https://aws.amazon.com/cloudhsm

Answer 2

If you are REALLY paranoid about security, you do not store the private key on the filesystem, you store it in hardware. A Hardware Security Module (HSM) from a company like SafeNet or Thales/nCipher is a physically hardened security appliance that is designed to product encryption keys. Once the keys are generated on the HSM they cannot be removed. That is, you can not extract the key and copy it off somewhere else to be used for malicious purposes. Additionally, they have hardened operating systems and software designed to prevent an attacker from being able to hack into the appliance. Too many unsuccessful logins? The device securely wipes its contents. Try to pry open the box to remove the flash memory holding the keys? There is epoxy on the physical hardware components and you will end up destroying them.

These devices also typically include cryptographic accelerators to increase the speed at which cryptographic operations are performed. They also tend to include standards-based APIs, such as PKCS#11 or JCE so it is easy to integrate with other software, such as Apache or your Java JVM.

An HSM is not cheap, but if you are really concerned about the security of your cryptographic material, this is how you protect it.