I am struggling with the question how to store a security key in a secure way. I have done some research and there are multiple options.
Option 1) Storing the key on the same server (not recommended, because an attacker might easily get access to the key if the server is hacked.
Option 2) Storing the key on another server (the attacker needs to get access to both servers). Both servers need to be secured. The key could be transmitted via SSL. This seems to be a quite often used approach.
Option 3) Using KMS like Google and Amazon (Problem: authentication to the server is required, so the key might also be available if the attacker has access to the server). Is there a workaround?
Option 4) Using HSM cloud server (in my opinion the best option relating to security but with high prices)
Are there other ways to secure a key in a good way? My use case: I have a cloud server with a database and would like to encrypt the database content. How can I secure the key so that it is not lost if an attacker has access to the webserver.
