CipherTrust Cloud Key Management

Encryption keys need to be managed whether the data is on premises or in a cloud. “Cloud keys” are encryption keys that enable organizations to secure data at rest with encryption across their cloud workloads without compromise to business functionality. Thales CipherTrust Cloud Key Manager (CCKM) adds controls that simplify and streamline the Cloud Administrator’s job so that organizations can efficiently meet compliance and best-practice requirements by generating, storing, managing and maintaining data encryption keys within a secure environment.

If your job is to administer cloud keys, and your network includes multiple clouds, you are responsible for learning the User Interface and vocabulary for each cloud and managing the different key management systems. You may also be responsible for pulling together a report that lists the expiration date of all the different Cloud Service Provider (CSP) Key Management Service (KMS) keys, being notified X days before the expiration event and rotating the keys before they expire.

If you use Cloud Native keys, you will need to learn and maintain knowledge of each corresponding KMS system. If you choose a centralized cloud key manager, such as CipherTrust Cloud Key Manager (CCKM), you only need to learn one straightforward User Interface (UI) that manages native, BYOK and HYOK keys with a single pane of glass view across regions.

If your job is to staff the cloud administrator role, and your network includes multiple clouds, you have the option of using a centralized cloud key manager and avoiding the need to hire specialists for each of the CSP KMS keys.

Cloud providers try to help customers secure their data, so they sometimes encrypt it, which requires encryption keys.  Key management is the general idea of generating keys for encryption and keeping them safe. Key Management as a Service (KMaaS) allows companies to manage encryption keys more effectively through a cloud-based solution instead of running the service on physical, on-premises hardware.  Some cloud providers enable customers to use their own keys, either using BYOK or HYOK.

Google Cloud platform offers both BYOK, with customer-managed encryption keys, or CMEK, and HYOK, with external Key Management [Services] or EKM.

Each cloud service provider (e.g., AWS, Azure, GCP) has their own key management service (KMS) as a convenience for their customers. A cloud service provider’s encryption and key management services are cloud-specific and require the cloud administrator to learn the vocabulary and quirks of each cloud vendor they are using.

A cloud vendor derives data encryption keys internally, from key material the KMS originated, or the cloud vendor can derive the key material from an external source -- BYOK or HYOK keys.

To achieve separation of duty, data sovereignty laws and regulatory requirements require the use of BYOK or HYOK keys in certain circumstances.

Using an external KMS enables you to choose a cloud-independent service that can increase efficiency for your cloud native keys. Using the right external KMS can also increase operational resiliency across vendors in the cloud and on premises, and provide BYOK and HYOK keys so that you remain in compliance with data sovereignty laws and regulatory requirements.