Code Signing Best Practices Pre & Post HSM (Hardware Security Module)

Comprehensive best practices for the management, storage, usage, and security of code signing certificates, also known as authenticode, pre-HSM and post-HSM (Hardware Security Module) for an enterprise organization.

Industry standards for Code Signing changed to require a Hardware Security Module for securing the private key. This change went into effect as of June 1, 2023, where private keys must be stored on hardware certified as FIPS 140 Level 2, Common Criteria EAL 4+, or equivalent.

0:00 Introduction
4:06 Why should you sign code?
5:28 What lead to the industry standards change?
7:04 How should code signing certificates be managed Pre/Post HSM
16:30 Introducing the Hardware Security Module
19:14 How should code signing certificates be issued Pre-HSM
29:00 How should code signing certificates be issued Post-HSM
37:30 HSM Code Signing Infrastructure
46:27 Engineering Team Autonomy
55:00 Final Points