CipherTrust Cloud Key Manager

Centralized lifecycle management for BYOK, HYOK and cloud native encryption keys

As a convenience to their customers, Cloud Service Providers (CSPs) increasingly offer their vendor-specific encryption and key management services. As a necessity for our customers, we offer vendor-independent encryption and key management services. We collaborate and innovate with CSPs and our customers to increase efficiency and operational resiliency across vendors in the cloud and on premises.

We develop products for you, always focused on the fact that as Cloud consumers, you are responsible for the security of your data stored and used in vendor clouds. CipherTrust Cloud Key Management (CCKM) protects your time as well as your data with a single pane of glass view across regions for cloud native, BYOK and HYOK keys and one straightforward UI to manage all cloud Key Management Services.

Take Control of Your Valuable Data Across Clouds

Separation of Duty:
Enforce separation of duty between your data and your cloud service provider (CSP) by securely storing encryption keys outside of the corresponding cloud.

Mitigate Risks:
Apply risk-appropriate key management controls and workload protection based on sensitivity of the data and compliance mandates.

Maximize Choice

Across Clouds:
Any combination of public clouds and private or on-prem data infrastructure.

Across Key Sources:
CipherTrust Manager (CM), Luna Network HSM, DSM, Native

Across Key Management Ownership Models:
BYOK, HYOK, Native

Increase Efficiency and Operational Resilience

Automate key lifecycle management across clouds and hybrid environments with processes and tools.

Processes include:
Key lifecycle management, Data protection

Tools include:

  • Single user interface across clouds
  • Common set of APIs across clouds
  • Single pane of glass view into where your keys are stored

Simplify Compliance

Digital Sovereignty has three pillars that give you control over your own digital destiny — your data, and the hardware and software you rely on.

Data Sovereignty: You maintain control over encryption and access to your data and comply with the data sovereignty laws by country. Easily demonstrate compliance with privacy regulations such as GDPR, SCHREMS II and PCI-DSS

Operational Sovereignty: Visibility and control over providers’ operations

Software Sovereignty: Run workloads without dependence on a provider’s software

Video Source: Thales CPL

Supported public clouds and key management ownership models:

Amazon Web Services (AWS) KMS

Native

BYOK

AWS CloudHSM

Native

AWS XKS

HYOK

AWS GovCloud

Native

BYOK

HYOK

Google Cloud Platform CMEK

Native

BYOK

Google Cloud Platform EKM

HYOK

Google Cloud Platform EKM UDE

HYOK-CC*

Google Workspace CSE

HYOK

IBM Cloud HPCS

Native

BYOK

IBM Cloud Key Protect

Native

BYOK

Microsoft Azure Cloud

Native

BYOK

Microsoft Azure GovCloud

Native

BYOK

Microsoft Azure Managed HSMs

Native

BYOK

Microsoft Office 365

BYOK

Oracle Cloud Infrastructure

Native

BYOK

Salesforce.com

Native

BYOK

HYOK**

Salesforce GovCloud Plus

Native

BYOK

HYOK**

Salesforce Sandbox

Native

BYOK

HYOK**

SAP Data Custodian

Native

BYOK

*HYOK-CC is HYOK for Confidential Computing
**Cache-only Key Service

Cipher Trust Cloud Key Management Frequently Asked Questions

Encryption keys need to be managed whether the data is on premises or in a cloud. “Cloud keys” are encryption keys that enable organizations to secure data at rest with encryption across their cloud workloads without compromise to business functionality. Thales CipherTrust Cloud Key Manager (CCKM) adds controls that simplify and streamline the Cloud Administrator’s job so that organizations can efficiently meet compliance and best-practice requirements by generating, storing, managing and maintaining data encryption keys within a secure environment.

If your job is to administer cloud keys, and your network includes multiple clouds, you are responsible for learning the User Interface and vocabulary for each cloud and managing the different key management systems. You may also be responsible for pulling together a report that lists the expiration date of all the different Cloud Service Provider (CSP) Key Management Service (KMS) keys, being notified X days before the expiration event and rotating the keys before they expire.

If you use Cloud Native keys, you will need to learn and maintain knowledge of each corresponding KMS system. If you choose a centralized cloud key manager, such as CipherTrust Cloud Key Manager (CCKM), you only need to learn one straightforward User Interface (UI) that manages native, BYOK and HYOK keys with a single pane of glass view across regions.

If your job is to staff the cloud administrator role, and your network includes multiple clouds, you have the option of using a centralized cloud key manager and avoiding the need to hire specialists for each of the CSP KMS keys.

Cloud providers try to help customers secure their data, so they sometimes encrypt it, which requires encryption keys.  Key management is the general idea of generating keys for encryption and keeping them safe. Key Management as a Service (KMaaS) allows organizations to manage encryption keys more effectively through a cloud-based solution instead of running the service on physical, on-premises hardware.  Some cloud providers enable customers to use their own keys, either using BYOK or HYOK.

Google Cloud platform offers both BYOK, with customer-managed encryption keys, or CMEK, and HYOK, with external Key Management [Services] or EKM.

Each cloud service provider (e.g., AWS, Azure, GCP) has their own key management service (KMS) as a convenience for their customers. A cloud service provider’s encryption and key management services are cloud-specific and require the cloud administrator to learn the vocabulary and quirks of each cloud vendor they are using.

A cloud vendor derives data encryption keys internally, from key material the KMS originated, or the cloud vendor can derive the key material from an external source — BYOK or HYOK keys.

To achieve separation of duty, data sovereignty laws and regulatory requirements require the use of BYOK or HYOK keys in certain circumstances.

Using an external KMS enables you to choose a cloud-independent service that can increase efficiency for your cloud native keys. Using the right external KMS can also increase operational resiliency across vendors in the cloud and on premises, and provide BYOK and HYOK keys so that you remain in compliance with data sovereignty laws and regulatory requirements.

Resources

ImageTitleLink
CipherTrust Cloud Key Manager Product Brief
CTO Sessions On Demand: Protecting Your Data in Their Cloud
CTO Sessions Webcast: A Guide to BYOK and HYOK for AWS, Azure, Google, Oracle and More
Microsoft Azure Advanced Data Protection Solution Brief
Solution Brief: Best Security Practices for milCloud Data Migration
Thales Security Solutions for Google Workspace
White Paper: Best Practices for Secure Cloud Migration
White Paper: The Case for Centralized Multicloud Encryption Key Management