Key Storage Providers: a Guide for Developers
Developers write code and don’t get involved with security, however, with the advent of DevOps developers are increasingly responsible for how well the code stands up to threat. One of the key ways that application security can be maintained is by code signing.
This gives end-users the ability to verify the code is genuine, tamper-free because the developer digitally signs the app.
When the app, software or IoT firmware is signed a key is provided which links the user to the certificate but this key must be protected so that hackers cannot sign software in the name of your organization.
A KSP (Key Storage Provider) for example, Microsoft Cryptographic API interface allows for key generation away from operating systems and software. They are extremely hard to develop hence developers turn to a KSP rather than write their own. KSPs differ from CPS which were the first type of cryptographic APIs. This has moved through various iterations until we have the KSPs of today.
A KSP is important because whichever one you use directly affects the storage of your key. The Microsoft Software Key Storage Provider comes as default with any new operating system and is usually enough for most use cases. However, you may need to look further if key protection is critical.
It is essential to protect your code signing certificate from the view of malicious individuals who can use it to sign software and pass it off as belonging to your company. It is usual, therefore, to physically secure keys using a smartcard or HSM (Hardware Security Module) and this is where the need for a specific KSP will come in.
KSP Enables Secure Code Signing
Most software developers are well aware that code should be signed and that being able to access the certificates rapidly is key to uninterrupted development life-cycles. However, IT security teams are more focused on protecting this sensitive information. Normal practices like duplicating keys and disseminating them to development teams mean that the code is insecure. Using a KSP means being able to sign from anywhere and at any time without having to physically access the key. This mitigates risk while maintaining the speed of development and release. As a result, both DevOps and IT Security teams are happy that they are in control and protecting the system from threats.
If you’re looking for a company that provides database design and other software development services, contact us.
