The service can generate and store keys in hardware security modules validated to FIPS 140-2 Level 3 or FIPS 140-3 Level 3, so that key material never exists in plaintext outside the module.
FIPS 140 Level 3 Hardware Security Modules
CCC.KeyMgmt.CP13
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.KeyMgmt.TH06 | Key Material is Generated or Stored Outside a Hardware Security Module | Keys may be created with a software protection level instead of being generated and held in a validated hardware security module. Key material then exists in a form that can be extracted or copied by a compromised host or privileged operator. Confidentiality of every item protected by the key is lost if the material is exfiltrated. |