dedicated hardware cannot be used, build a clean host OS each time the CA VMs need to be brought online When virtualizing offline CAs, securely build the VM on the Tactical Medium dedicated hardware, do not build it on an online host and migrate it to the dedicated hardware Prior to performing any operations on an offline CA, verify Tactical Medium the system time is correct. When virtualizing offline CAs, perform regular backups of Tactical Medium hard disk files. Securely store the backups along with any required software at a backup site When virtualizing online CAs, access to the host to Tactical High only those who should have access to the PKI Internal When virtualizing online CAs, use network attached HSMs Tactical High for key protection Internal When virtualizing online CAs, continue to take regular CA Tactical Medium backups with all data needed to restore the CA If using software keys, protect all key backups (PKCS#12, Tactical Medium PFX files) with the same level of protection provided to the CA Do not include backups of the private key as part of the Tactical Medium standard backup process. Backup the key(s) as needed and physically protect them by storing in a safe, within a tamper-evident bag and audit all access to the backup Do not connect backup systems directly to the CA. Backup Tactical High the CA to another location which is backed up regularly to Internal eliminate the need for backup software on the CA Isolate certificate systems from other systems on the Strategic High network External Implement “security to isolate certificate systems Strategic High based on their criticality and relationship to each other External
dedicated hardware cannot be used, build a clean host OS each time the CA VMs need to be brought online When virtualizing offline CAs, securely build the VM on the dedicated hardware, do not build it on an online host and migrate it to the dedicated hardware Tactical Medium Prior to performing any operations on an offline CA, verify the system time is correct. Tactical Medium When virtualizing offline CAs, perform regular backups of hard disk files. Securely store the backups along with any required software at a backup site Tactical Medium When virtualizing online CAs, access to the host to only those who should have access to the PKI Tactical High Internal When virtualizing online CAs, use network attached HSMs for key protection Tactical High Internal When virtualizing online CAs, continue to take regular CA backups with all data needed to restore the CA Tactical Medium If using software keys, protect all key backups (PKCS#12, PFX files) with the same level of protection provided to the CA Tactical Medium Do not include backups of the private key as part of the standard backup process. Backup the key(s) as needed and physically protect them by storing in a safe, within a tamper-evident bag and audit all access to the backup Tactical Medium Do not connect backup systems directly to the CA. Backup the CA to another location which is backed up regularly to eliminate the need for backup software on the CA Tactical High Internal Isolate certificate systems from other systems on the network Strategic High External Implement “security to isolate certificate systems based on their criticality and relationship to each other Strategic High External
Securing%20Public%20Key%20Infrastructure%20(PKI).docx