DataTerminology.comNEW
Also known as: HSM
A tamper-resistant device that safeguards cryptographic keys and performs secure cryptographic operations.
DESCRIPTION
A hardware security module (HSM) is a purpose-built, tamper-resistant device that protects cryptographic keys, enforces key use policies, and accelerates cryptographic operations. Organizations use HSMs to secure certificate authorities, signing keys, payment cryptography, and secrets for data encryption. HSMs help meet compliance requirements such as FIPS 140-3 by providing strong physical and logical protections. They support key lifecycle management, including generation, storage, rotation, backup, and destruction. HSMs can be deployed as on-premises appliances or consumed as managed services in the cloud.
ALTERNATIVE DEFINITIONS
NIST CSRC Glossary
A physical computing device that safeguards and manages digital keys for strong authentication and provides cryptoprocessing.
Highlights both key management and on-device cryptoprocessing as core HSM capabilities.
Cloudflare Learning Center
A hardware security module (HSM) is a dedicated, tamper-resistant device used to protect cryptographic keys and perform cryptographic operations.
Emphasizes tamper resistance and the dual role of key protection and cryptographic processing.
RELATED TERMS
Public Key Infrastructure Key Management Service FIPS 140-3 Digital Signature Certificate Authority TLS Envelope Encryption Secure Enclave Key Rotation
COMPETING TERMS
Trusted Platform Module Software Key Store
KNOWLEDGE AREAS
Data Security Infrastructure Cloud Data Management
TARGET AUDIENCE
Security Architect Cybersecurity Engineer Chief Information Security Officer Cloud Architect Software Developer IT Auditor Data Engineer
EXTERNAL SOURCES
- Wikipedia - Hardware security module
- NIST - FIPS 140-3 security requirements for cryptographic modules
- AWS - AWS CloudHSM product overview and concepts
- Microsoft - Azure Key Vault Managed HSM overview
- Google Cloud - Cloud HSM concepts and usage
TOP QUESTIONS
What is a Hardware Security Module used for?
An HSM securely generates, stores, and uses cryptographic keys for encryption, signing, and authentication. It protects keys from extraction and enforces strict access and usage policies.
Category: Overview
Why choose an HSM over software key storage?
HSMs offer tamper resistance, hardware-backed isolation, and rigorous certifications like FIPS 140-3 that software stores cannot match. This materially reduces key theft risk and supports compliance.
Category: Relevancy
How does an HSM integrate with cloud services?
Cloud providers offer managed HSM services with APIs and integrations to key management and certificate services. These provide elasticity while maintaining hardware-backed key protection.
Category: Integration
What are common mistakes when deploying HSMs?
Mismanaging key lifecycles, weak quorum policies, inadequate backup and disaster recovery, and leaving audit logs unmonitored are frequent pitfalls that undermine security assurances.
Category: Mistakes
What certifications matter for HSMs?
FIPS 140-3 validation, Common Criteria evaluations, and PCI HSM for payment use cases are commonly required to meet regulatory and industry expectations.
Category: Standards
How do HSMs help with compliance?
HSM controls and audit trails help satisfy requirements for key custody, separation of duties, and cryptographic strength in regulations like PCI DSS and various privacy laws.
Category: Compliance
What is the performance impact of using an HSM?
HSMs often accelerate asymmetric operations and offload crypto at scale. Proper connection pooling and load-balancing minimize latency impact for high-throughput systems.
Category: Performance
How are keys backed up from an HSM?
Keys are typically backed up in encrypted, HSM-wrapped form with quorum controls. Backups should be tested regularly and stored separately to prevent correlated failures.
Category: Operations
What is a common alternative to HSMs?
Trusted Platform Modules (TPMs) and software key stores are alternatives. TPMs protect device-bound keys, while software stores are less secure but simpler to operate.
Category: Alternatives