Data and cryptography
What this is
This area covers the protection of the keys everything else depends on. Encryption is only as good as the place the key is kept. A hardware security module generates key material inside a sealed device, performs the encryption, decryption and signing there, and never lets the key out.
Why it matters
Software can copy a key. That is what software is for. A key held in software can be read by a process, written to a log, captured in a memory dump or carried out inside a backup, and none of those events looks like an attack while it is happening. Moving the key into hardware removes the possibility instead of reducing the odds.
It is also why this requirement usually appears in the procurement document rather than the architecture document. A tender for payment, certificate or public infrastructure names the certification by number, and a product that does not hold it is not evaluated. The question is not whether the data is encrypted. It is where the key lives, which authority certified the device it lives in, and who can be compelled to produce it.
What it solves
- Key material that can be copied out of a running system without anything looking wrong
- Tender requirements that name a certification level as a condition of bidding
- Cloud adoption where the organisation has to hold its own keys
- Signing infrastructure where the private key cannot be allowed to exist in software
In our portfolio
Next to this
Email and file encryption is a different problem with the same word attached. It protects a message in transit rather than the key behind the system, and it sits in the human layer, with BeamSec.