DevOps challange

Please create a set of steps to manage private keys with different criticalness, including steps to create, store (backup) and use them.

Please include steps for low critical keys (insignificant damage if leaked or lost), medium level (significant damage if leaked or lost), and highly critical keys (should NEVER be leaked or lost).

Please make the right balances between convenience and security.

In the steps, also list the roles will be involved. e.g. DevOps can create and rotate low critical keys and Developer can access it. Multiple Executives will be involoved when creating highly critical keys.

Example:

• Low critical key:
  • Create
    • Can be performed by DevOps
    • Create a new EC2 instance
    • Deploy key management server
    • Use the key management server to generate the key
  • Store & Backup
    • Can be setup by DevOps
    • Save the key locally in EC2
    • Daily EBS snapshots
  • Access
    • Can be performed by DevOps or Developer
    • ssh into the server and use the key to sign message

Materials that could be helpful:

https://en.bitcoin.it/wiki/Cold_storage

https://en.wikipedia.org/wiki/Key_ceremony

https://en.bitcoin.it/wiki/Multisignature