Code Signing Best Practices Pre & Post HSM (Hardware Security Module)

Video Description

Comprehensive best practices for the management, storage, usage, and security of code signing certificates, also known as authenticode, pre-HSM and post-HSM (Hardware Security Module) for an enterprise organization. Industry standards for Code Signing changed to require a Hardware Security Module for securing the private key. This change went into effect as of June 1, 2023, where private keys must be stored on hardware certified as FIPS 140 Level 2, Common Criteria EAL 4+, or equivalent. 0:00 Introduction 4:06 Why should you sign code? 5:28 What lead to the industry standards change? 7:04 How should code signing certificates be managed Pre/Post HSM 16:30 Introducing the Hardware Security Module 19:14 How should code signing certificates be issued Pre-HSM 29:00 How should code signing certificates be issued Post-HSM 37:30 HSM Code Signing Infrastructure 46:27 Engineering Team Autonomy 55:00 Final Points