How should I go about handling my RSA Private Key for my high-security Rails web application?
This may seem like a "soft" question, not related to cryptography per-se, but is nevertheless very important. What management procedures and general development security tenets should I be following? What are the definitive resources detailing how to prevent not only the technological side of hacking, but also the inevitable failures in human resources and plain old theft?
Up until now I have been generating RSA keypairs on my local MAC machine, placing them in an applications' /secret folder, committing them to private git repos and then deploying to server. While no incidents (yet) have occurred, I can see that there are two main security concerns - access to Git repos either via hacking my account or Git backend or theft/access to my machine. In regards to these two, I can only increase the strength of my Git and machine passwords, increasing the physical security of the offices is another possibility.
Thinking back to first principles of security, I have been considering generating keypairs for an application on the secured application server (access on a custom port using public keys only) and never committing them to a repository of any kind, however there are cases when the private key is needed even in development, so I would scp
the key from the server onto my local machine, exposing my application once again to physical security risks.
Am I overthinking this? What am I missing?