Benefits

Reduced Likelihood of Breaches

An attacker must generate or have access to a workload protected by confidential computing but implementing data weaknesses (intentional or otherwise) and arrange for this to be erroneously enrolled on the HSMAttest whitelist. To achieve this against HSMAttest Protection, a formidable number of steps in the governance, software supply and operations chains must be broken.

Reduced Impact of Breaches

An initial breach of a system is usually followed by an escalation of access by the attacker - HSMAttest limits this by only ever releasing limited use assets that, for example a key that can decrypt only one database record, or expires after half an hour.

Transparency of Governance

Nothing is allowed by default, except the initial creation of the first Governing user. Every trust decision is based on a Governance decision that is in a direct chain of positive decisions leading back to the initial setup.

e.g. Something is allowed because X allowed it. X can allow because Y granted X that permission, Y was allowed to grant that permission because Z granted the permission to allow to Y. Z was created by the initial Governor User with the permission to grant certain other permissions to other users. The initial Governor user was created on during a ceremony documented here ...

This chain can be followed by an auditor at any time.

Insider and Operator Exclusion

The Governance transparency and explicitness above means that it is possible to define clearly who has access to what. And also therefore, by exclusion who does NOT. e.g. random colleagues, external suppliers, Hosting providers, State actors, etc.

Operations Ready

HSMAttest provides support for operations through:

• Robust High Availability and Scaling support through the use of external HSM storage.
• HSMAttest provides tools to support and simplify operational actions - Everyone knows that if security is too difficult or complicated to use then it will be bypassed (passwords on Post-its, etc.)
• Support for SIEM with HSM Audit Events for security relevant situations.
• Support for HSM performance monitoring at the level of individual HSM calls.
• Best Practices knowledge base and guidelines, including Secure Software Supply Chain Integration.

Hardening against Multi-Vector (AI) Attacks

HSMAttest reduces exposure; it does not remove every risk. Anyone promising that is lying. The difficulty of attacking an HSMAttest System is increased and the potential benefit of doing so is reduced. In the coming world of AI-agentic multi-vector attack scenarios we must assume that breaches will come and be ready to limit their damage and thereby render them uneconomic.

HSMAttest does not replace good security hygiene - it enhances it. Protection depends on the HSM, confidential-computing platform, workload design and effective governance all working together. For example, derived keys and the data they can access still need appropriate scope and lifetime limits.

Main Vulnerabilities

HSMAttest can NOT protect against:

• Clever social engineering attacks targeting the genuine, legitimate Governors.
• Designed-in security weaknesses, e.g. misplaced trust in the transfer of data to third parties outside the HSMAttest and Confidential Computing boundary.
• Attacks on the HSM manufacturing and delivery supply chain or on the HSMAttest supply chain itself. Here only peer review, certification and authenticated delivery channels can help.