TSM500i and TsmWeb User Guide (PCI HSM v3) (PR-D2-1037 Rev 1.1)
| Page 8
Zazoo Limited, Co. No 9265606 | Directors: Dr S C P Belamant (French),
Mr H G Kotze, Mr P M Belamant | Company Secretary: Ms C W van Straaten
www.zazooltd.com
2
INSTALLATION & SECURITY PROCEDURES
2.1
QUICK GUIDE: FROM INSTALLATION TO OPERATION
(See 2.2)
The TSM500i and its Critical Security Parameters (CSPs) must be handled in accordance
with documented security procedures in order to meet the security requirements of the
Banking Industry and standards bodies. Refer to
Sample Security producedure.pdf
(See 2.3)
The TSM500i NSS / PCIe hardware must be inspected and then installed in a secure
environment in accordance with the procedures detailed in this user guide
(See 2.4)
Power on and check physical indicators (LEDs) to confirm that the hardware has been
successfully installed
(See 2.5)
PCIe ONLY:
Install device driver. Run TSM500 PCI Installer which installs Conductor,
documentation & TSM-WEB. Install Java J2RE.
(See 2.6)
NSS ONLY:
Set the IP address, network mask and default gateway using the LCD Menu
which is accessed via the front panel
(See 2.7)
Enter the IP address into a Web Browser on a PC that is connected to the same subnet to
access TSM-WEB. Set the TSM-WEB admin user account password. Login to TSM-WEB as
admin and perform a basic functionality test.
The TSM500i is shipped
without Crypto Officer passwords
.
A two- step process is used to authenticate the HSM at the place of initial deployment,
and to simultaneously set the initial 2 crypto officer passwords. This process is used to
transfer control of the HSM from the Manufacturer to two Customer crypto officers
.
If required, the date and time can be set to match your time zone
(See 2.10)
TSM500i-NSS:
Conductor is preinstalled and is managed by TSM-WEB.
TSM500i-PCIe:
Use Conductor Setup to configure and install a Conductor service. See
Conductor User Guide for more details.
(See 2.11)
Setup TSM-WEB access control by creating TSM-WEB user accounts, setting the
password policy and default auto-logoff times
(See 2.12)
Follow the backup procedure to backup TSM-WEB settings:
(See 2.13)
CSPs must be loaded into the TSM500i to configure it for operational use. The most
important CSP is usually the Storage Master Key (SMK), which is split between several
custodians in the form of components. If required, additional TSM500i HSM operational
permissions can be set at this point.
(See 2.14)
Client software must be configured to communicate with Conductor and/or the TSM500i,
then tested to ensure that transaction processing can proceed successfully. Third-party
tools will be used during this step.
Establish Security Procedures
Inspect and Install Hardware
Access TSM-WEB Interface
Authenticate HSM
and Set Initial Passwords;
Set Date & Time
TSM-WEB Access Control
Prepare TSM500 for Operation:
Load CSPs
Configure and Test Client
Software
Check Physical Indicators
PCIe: Install Driver & SW
NSS: Network Setup
Backup Settings
Configure and Test Conductor
