ZAZO TsmWeb TSM500i User Manual Download Page 37

Page: 37 / 49

TSM500i and TsmWeb User Guide (PCI HSM v3) (PR-D2-1037 Rev 1.1)

| Page 37

Zazoo Limited, Co. No 9265606 | Directors: Dr S C P Belamant (French),

Mr H G Kotze, Mr P M Belamant | Company Secretary: Ms C W van Straaten

www.zazooltd.com

4.8

Backup and Restore

4.8.1

Backup & Restore on a TSM500i-NSS

This procedure is only applicable to the

TSM500i-NSS

(it does not apply to a TSM500i-PCIe).

Backup

Refer to section 2.12 for the procedure to backup NSS settings and the TSM-WEB database to a directory
“NSS_BACKUPS” on the root of a flash drive.

Restore

A USB flash drive that has the “NSS_BACKUPS” directory from a previous backup operation is required for a
restore.



Switch the TSM500i-NSS off.



The flash drive should be plugged into the USB

ervice

port on the front panel.



Power it on again and hold down the green



button and red



button on the TSM500i-NSS

front panel until the MAIN MENU appears on the LCD display. Refer to APPENDIX B – LCD
SEQUENCE for a flow chart of the menu functions. This takes approximately 20 seconds.



Scroll down to USB Restore option on the MAIN MENU and press the green



button to select.

Confirm using the left arrow button. The message ‘NSS Restore’ is displayed followed by NSS
Restore – Success.



Wait for the Main Menu to appear on the LCD. Select Continue Reboot.

Summary of Contents for TsmWeb TSM500i

Page 1: ...M as well as the TsmWeb interface used to manage this HSM Company Confidential The information in this document is intended only for the person or the entity to which it is addressed and may contain c...

Page 2: ...kaging in an anti static bag in foam padded box Failure to do so could result in damage to the HSM The original packaging should be kept in a safe place in case it becomes necessary to transport the H...

Page 3: ...13 2 6 NETWORK SETUP RECOVERY 14 2 6 1 Use the LCD MENU to set the IP address 14 2 7 TSM WEB INTERFACE 15 2 7 1 Invoking TSM WEB for a TSM500i PCIe 15 2 7 2 Invoking TSM WEB for a TSM500i NSS 15 2 7 3...

Page 4: ...eys 27 3 HSM PASSWORD MANAGEMENT 28 3 1 How to add a Crypto Officer 28 3 2 How to change an existing password 29 3 3 Reset One Password 30 3 4 Reset CSPs clear all passwords and set passwords 31 4 ONG...

Page 5: ...11 Disabling and Enabling SSL TLS 40 4 11 1 Disable TLS from the LCD MENU 40 4 11 2 Disable or Enable TLS from TSM WEB 40 4 12 Upgrading TSM500i firmware 41 4 13 Upgrading TSM500i NSS System Software...

Page 6: ...s responsibility to procure and setup a server that will house the TSM500i PCIe Note that a physical computer is required the TSM500i PCIe cannot be installed in a virtual machine It is also necessar...

Page 7: ...the KCED port on the front panel In the case of a TSM500i PCIe it connects to the RED port on the connector panel this is the connector closest to the status LEDs Whenever the KCED is connected to th...

Page 8: ...A two step process is used to authenticate the HSM at the place of initial deployment and to simultaneously set the initial 2 crypto officer passwords This process is used to transfer control of the...

Page 9: ...liance guidelines that are a good reference for creating security procedures A valuable source of information is the PCI PIN Security Requirements At minimum the following issues should be addressed T...

Page 10: ...packaging and hardware are intact Also verify that is no sign of physical damage Verify that the hardware has not tampered Power on hardware and if red status LED is permanently ON then the hardware...

Page 11: ...Access to the expansion slot may differ for machines from different vendors please refer to your vendor documentation Remove the TSM500i from the protective static bag To prevent Electro Static Discha...

Page 12: ...a healthy maintenance state If the module is required to be in the operational state it will need to be reset ON 1 FLASH Tampered state Remove and physically inspect the module according to standard s...

Page 13: ...Driver folder of the TSM5XX Support CD to select the appropriate driver for your Windows operating system Install Conductor and TSM WEB Run TSM5XX PCI_Installer exe provided on the TSM5XX Support CD...

Page 14: ...LCD display After about 30 seconds the following prompt will be displayed briefly for menu Press and hold down the red button and green button on the front panel until a MAIN MENU appears on the LCD...

Page 15: ...Enter http localhost as the URL into your Web Browser when using TSM500i PCIe Note that TSM WEB and Conductor must have been installed see section 2 5 2 7 2 Invoking TSM WEB for a TSM500i NSS When us...

Page 16: ...after clicking I understand the risks 2 7 3 1 Setting Admin Password for the first time If no admin user password has been set the user will be presented with a screen titled TSM WEB Set Admin Passwor...

Page 17: ...nutes of inactivity This timeout period can be configured via Preference Manager page on TSM WEB When using TSM WEB on a TSM500i NSS you will always be required to enter a password When using a TSM500...

Page 18: ...read the Access Control Mode that is reported The Access Control Mode specifies 1 Whether the module is in the Loader state i e running the Boot Loader Loader Tampered state or in the Operational sta...

Page 19: ...in response to the last challenge issued 2 8 3 Authenticate HSM Finalise Step To perform this operation you must have completed the Request step and received the necessary response from the Manufactu...

Page 20: ...successful completion of the above step the HSM will have been authenticated to have originated from the Manufacturer and verified to have not been modified 2 8 4 Add additional crypto officers Refer...

Page 21: ...rt daylight saving time The HSM s date and time is a Critical Security Parameter for certain cryptographic functions and should be corrected at this point This service requires two Crypto Officers to...

Page 22: ...eration it is strongly recommended that the Default trace level be used This will log all errors and most warnings Selecting either of the other two options Verbose or Debug will result in performance...

Page 23: ...o login to TSM WEB 2 11 2 Configuring Account and Password Policy TSM WEB account and password policy is configured in the Preference Manager which is accessed by clicking Preference Manager from the...

Page 24: ...ash drive using the LCD MAIN MENU Power the TSM500i NSS off Insert a USB flash drive into the USB port on the front panel of the TSM500i NSS Power it on again and hold down the red button and green bu...

Page 25: ...tate is AC OPERATIONAL and then click Login on the TSM Management page The TSM Management page will reload after the cryptographic officers have successfully logged in to the TSM500i Select the tab la...

Page 26: ...refer to the KCED Installation and User Guide for details on how to use the Key Component Entry Device KCED Procedure Click on the TSM Management page Two cryptographic officers must login using the K...

Page 27: ...list of permissions represented by respective mnemonics as shown in the permissions table Once all of the required permissions have been entered and those to be unset removed click on Set permissions...

Page 28: ...r connecting cable for any signs of tampering or insertion of a bugging device Requirements Logged into TSM WEB and the KCED connected to the TSM500i This service can only be performed if the module i...

Page 29: ...the KCED is connected to the HSM the Cryptographic Officers must inspect the HSM the externally connected device and the inter connecting cable for any signs of tampering or insertion of a bugging dev...

Page 30: ...r These tokens will only be sent to the email specified on the signed letter The tokens may only be used once where after they will not function Whenever the KCED is connected to the HSM the Cryptogra...

Page 31: ...where after they will not function Both crypto officers must be present during this command Whenever the KCED is connected to the HSM the Cryptographic Officers must inspect the HSM the externally con...

Page 32: ...me of the TSM500i NSS reported at bottom of TSM WEB home page and the time of the HSM are correct and synchronized If not setting the date and time in accordance with section 2 9 will set both clocks...

Page 33: ...ng the procedure provided by the vendor of the software that drives the TSM500i 2 Export the encrypted keys from the database to a CSV Excel file 3 Use Excel to make necessary format changes to ensure...

Page 34: ...red is visible to nobody except the custodian responsible for the component otherwise the SMK could be compromised 4 4 3 Translate Keys Note After loading the Migration SMK you will need to reload the...

Page 35: ...the above the status report also provides an Audit Log containing all module Bootloader Audit Log entries This audit log gives the date and time of events such as hardware resets operator logins tamp...

Page 36: ...until a MAIN MENU appears on the LCD display The arrow keys may be used to select the required option For details on how to navigate and use the MAIN MENU refer to section 2 6 1 or APPENDIX B LCD SEQ...

Page 37: ...USB flash drive that has the NSS_BACKUPS directory from a previous backup operation is required for a restore Switch the TSM500i NSS off The flash drive should be plugged into the USB Service port on...

Page 38: ...e Prism TSM WEB service to be stopped and then restarted once the backup is complete Backup the files tsmweb sqlite and tsmweb prop found in C Program Files Prism TsmWeb using a file backup program e...

Page 39: ...wd option to ERASE the current Admin Password Once this has been done a new Admin Password may be set as described in section 2 7 3 1 4 9 2 Config Reset Selecting the Config reset option from the RESE...

Page 40: ...gorithm can be changed via the Preferences Manager both RSA and EC key types are supported It must be noted however that EC is not supported in Internet Explorer but has been tested successfully in bo...

Page 41: ...han the current version then the Crypto Officer role will need to be assumed When updating the TSM500i firmware the Access Control Mode should be BL LOADER_ROLE_OFFICER if loading firmware of same typ...

Page 42: ...o time to provide an update to one or more of the software components that run on the TSM500i NSS embedded computer If you receive an NSS software upgrade from Prism the mechanism for these software u...

Page 43: ...environment for a different purpose This service can only be performed if the module is in the Loader state and requires both Crypto Officers to have logged in i e Access Control Mode must be BL LOAD...

Page 44: ...CER Before clearing the tamper it is advisable to first ascertain the cause of the tamper To do this select the TSM Status page from the side menu and observe what is reported under the headings Activ...

Page 45: ...y the comma character No field may contain a comma Using double quotes to enclose a field that contains a comma is not valid The double quotes will be assumed to be part of the field value Leading and...

Page 46: ...in the output file Key space ID Number The ID of the key space under which the key is encrypted Key Type Number The key type as used by the MCM API Key Hex string The key encrypted under the current K...

Page 47: ...User Guide PCI HSM v3 PR D2 1037 Rev 1 1 Page 47 Zazoo Limited Co No 9265606 Directors Dr S C P Belamant French Mr H G Kotze Mr P M Belamant Company Secretary Ms C W van Straaten www zazooltd com APPE...

Page 48: ...and TsmWeb User Guide PCI HSM v3 PR D2 1037 Rev 1 1 Page 48 Zazoo Limited Co No 9265606 Directors Dr S C P Belamant French Mr H G Kotze Mr P M Belamant Company Secretary Ms C W van Straaten www zazoo...

Page 49: ...ards and Technology NSS Networked Security Server refer to TSM500i NSS PC Personal Computer often used to refer to any Windows based computer PCI 1 Payment Card Industry when referring to security sta...

Search results

Summary of Contents for TsmWeb TSM500i

Reviews:

Related manuals for TsmWeb TSM500i

Brands by name

Popular brands

ZAZO TsmWeb TSM500i, User Manual

Search results

Summary of Contents for TsmWeb TSM500i

Reviews:

Related manuals for TsmWeb TSM500i

Brands by name

Popular brands