Hardware security keys and HSMs
A hardware security key proves who you are with a chip that holds the private key and never gives it up. Used with FIDO2 and WebAuthn, it stops phishing because the key only answers the real website. A hardware security module (HSM) does the same job for server keys: signing and encryption happen inside the device.
What we do
- Key rollout by role
- Spare and recovery key plan
- Signing key protection design
- HSM or cloud KMS choice
- Key use policy and audit logs
- Lost device process
- Staff guidance
Our team works with YubiKey and Nitrokey for staff sign-in, with YubiHSM 2 for small signing and key-protection jobs, and with the cloud key services from Google Cloud and AWS, which offer HSM-backed keys. We plan key issuing, spare keys, lost-key recovery and the policy that decides who must use a key.
This group links to our Cybersecurity and Cloud services. Secrets and vault tools are covered in the key management group. These are tools our team has experience with, not partnerships.
Leading platforms we work with
- Yubico YubiKey
- Nitrokey
- YubiHSM 2
- Google Cloud KMS
- AWS KMS
- Thales Luna
- Entrust nShield
Platforms and practices
- FIDO2 and WebAuthn sign-in
- Security keys for administrators
- Spare key and recovery plan
- Key inventory and issuing
- Code and document signing keys
- HSM-backed key storage
- Access policy for key use
- Lost key revocation
References
Sources last checked .
Product names are trademarks of their owners and are listed to describe our experience; they do not imply endorsement or partnership.
How we use Hardware security keys and HSMs for clients
Cybersecurity
We find out whether everything you run is safe from attackers, then we fix it.
Learn moreCloud Management
Cloud cost review and management, without compromising on quality or security.
Learn moreManaged IT Services
We run your IT day to day so it stays secure: help desk, devices, Microsoft 365, Exchange, Active Directory, backups, networks and monitoring.
Learn moreFrequently asked questions
Direct answers to the questions we hear most. Something else on your mind?
Send us a messageWhat if someone loses their security key?
Each person should register at least two keys, so a lost key does not lock them out, and keep the spare in a safe place. The lost key is then revoked in the identity provider. Administrators keep a documented recovery path. We plan the spare keys and the lost-key process before issuing anything.
Are hardware keys better than an authenticator app?
For phishing, yes. A FIDO2 or WebAuthn security key only answers the genuine website, so a fake login page cannot capture the sign-in. Codes from an authenticator app can be typed into a fake page and passed on. Keys are usually required first for administrators and high-risk roles.
Do we need an HSM, or is a cloud key service enough?
It depends on what you sign or protect and on any rule that applies to you. Cloud key services such as Google Cloud KMS and AWS KMS offer HSM-backed keys and suit most workloads. A small device such as YubiHSM 2 fits signing jobs that must stay on site. If a regulator or customer requires a certain validation level, ask them and check with your assessor.
Who should have to use a security key?
Start with administrators, finance staff who approve payments and anyone who holds access to sensitive systems. The policy can then widen to everyone as the rollout allows. Keys work together with a password manager and passkeys, and the policy says which accounts require a key and which can use other methods.