9

We are relatively small software company who has a requirement to store PAN's for our customers. Hosted payment solutions just don't fit our product requirements. We literally have 3 lines of encryption Code in C# which currently uses Ent Lib.

We have taken some consultancy from a very knowledgeable QSA and we have worked out how we are going to fundamentally re-architect our solution so that whole product doesn't fall under the scope of PCI compliance which would stop our ability to innovate.

I now have a shopping list and a very tight budget. The one item that is causing me a significant headache is PCI key management solution. HSM's are expensive and the equivalent software solutions are also surprisingly expensive. We consistently getting quotes in the region of £30,000 to £50,000 for something I would expect to be no more than £1000 per server plus free dev licences. We only require 2 servers with a luke warm standby to access the secure keys. It seems the letters PCI are adding zeros onto the price for something that conceptually not be that hard!

Is anyone using cost effective solution their QSA is happy with. I get the feeling the QSA's want the Rolls Royce/Ferrari when an entry level Mini would do for a lot of companies. I am happy to spend money and I guess I have reset my sights a little but something under £5000 would be a realistic budget for us.

Improve this question
2
  • 1
    Curious to know what did you end up choosing.
    – Nimbuz
    Commented Dec 10, 2012 at 16:03
  • It appears that in an attempt to conform to PCI compliance, you must purchase an inelastic good. Invariably, the price will be disproportional to utility of the good due to the inelastically of demand. In layman's terms, you have to have it so they can charge what they want.
    – recursion.ninja
    Commented Feb 22, 2014 at 18:18

2 Answers 2

Reset to default
4

One of the main difficulty with good key management is secure storage of encryption keys. If you look at what the NIST is saying on this subject (SP 800-57), you basically have three options:

  • Use HSM
  • Use physical security (put your key in a safe)
  • Store your key directly on the system, encrypted by a Key-Encryption-Key (this option is frequently used, but does not solve your problem, because your top KEK has to be securely stored as well !)

You already stated that HSMs are expensive so you still have the safe option. The main problem in this case is that your servers cannot get the key automatically when they need it, so you have to make sure that:

  • Your application needs to get the key only once (it is then stored in memory)
  • You can have someone type the key each time you boot your application

Obviously, you still have to define secure procedures for every aspect of the key management, but in certain cases, it can be a viable and cheap option.

Improve this answer
1

Townsend Security (I work with) has a very aggressively priced encryption key management HSM (http://townsendsecurity.com/products/encryption-key-management). It is FIPS 140-2 certified and can help you meet your PCI requirements. Review this white paper and let us know what you think: http://web.townsendsecurity.com/key-management-for-pci-web/

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .