As per PCI-DSS requirements, we have to use either HSM (Hardware Security Module), or Key Server to store the KEK (Key Encryption Key).
If I'm storing encrypted DEK (Data Encryption Key) in an App Server, how can I securely store the KEK which encrypts the DEK?
The two options:
If I decide to use a Key Server, then if someone hacks the App Server, he could easily gain access to the Key Server. So how to protect my Key Server?
If HSM is used for storing the KEK, then if someone hacks my app server, can they hack my HSM too?
Which of the two would be a more secure way, HSM or a Key server?