As a convenience to their customers, Cloud Service Providers (CSPs) increasingly offer their vendor-specific encryption and key management services. As a necessity for our customers, we offer vendor-independent encryption and key management services. We collaborate and innovate with CSPs and our customers to increase efficiency and operational resiliency across vendors in the cloud and on premises.
We develop products for you, always focused on the fact that as Cloud consumers, you are responsible for the security of your data stored and used in vendor clouds. CipherTrust Cloud Key Management (CCKM) protects your time as well as your data with a single pane of glass view across regions for cloud native, BYOK and HYOK keys and one straightforward UI to manage all cloud Key Management Services.
Take Control of Your Valuable Data Across Clouds
Separation of Duty:
Enforce separation of duty between your data and your cloud service provider (CSP) by securely storing encryption keys outside of the corresponding cloud.
Apply risk-appropriate key management controls and workload protection based on sensitivity of the data and compliance mandates.
Video Source: Thales CPL
Any combination of public clouds and private or on-prem data infrastructure.
Across Key Sources:
CipherTrust Manager (CM), Luna Network HSM, DSM, Native
Across Key Management Ownership Models:
BYOK, HYOK, Native
Increase Efficiency and Operational Resilience
Automate key lifecycle management across clouds and hybrid environments with processes and tools.
Key lifecycle management, Data protection
- Single user interface across clouds
- Common set of APIs across clouds
- Single pane of glass view into where your keys are stored
Digital Sovereignty has three pillars that give you control over your own digital destiny — your data, and the hardware and software you rely on.
Data Sovereignty: You maintain control over encryption and access to your data and comply with the data sovereignty laws by country. Easily demonstrate compliance with privacy regulations such as GDPR, SCHREMS II and PCI-DSS
Operational Sovereignty: Visibility and control over providers’ operations
Software Sovereignty: Run workloads without dependence on a provider’s software
Supported public clouds and key management ownership models:
Amazon Web Services (AWS) KMS
Google Cloud Platform CMEK
Google Cloud Platform EKM
Google Cloud Platform EKM UDE
Google Workspace CSE
IBM Cloud HPCS
IBM Cloud Key Protect
Microsoft Azure Cloud
Microsoft Azure GovCloud
Microsoft Azure Managed HSMs
Microsoft Office 365
Oracle Cloud Infrastructure
Salesforce GovCloud Plus
SAP Data Custodian
*HYOK-CC is HYOK for Confidential Computing
**Cache-only Key Service
Cipher Trust Cloud Key Management Frequently Asked Questions
Encryption keys need to be managed whether the data is on premises or in a cloud. “Cloud keys” are encryption keys that enable organizations to secure data at rest with encryption across their cloud workloads without compromise to business functionality. Thales CipherTrust Cloud Key Manager (CCKM) adds controls that simplify and streamline the Cloud Administrator’s job so that organizations can efficiently meet compliance and best-practice requirements by generating, storing, managing and maintaining data encryption keys within a secure environment.
If your job is to administer cloud keys, and your network includes multiple clouds, you are responsible for learning the User Interface and vocabulary for each cloud and managing the different key management systems. You may also be responsible for pulling together a report that lists the expiration date of all the different Cloud Service Provider (CSP) Key Management Service (KMS) keys, being notified X days before the expiration event and rotating the keys before they expire.
If you use Cloud Native keys, you will need to learn and maintain knowledge of each corresponding KMS system. If you choose a centralized cloud key manager, such as CipherTrust Cloud Key Manager (CCKM), you only need to learn one straightforward User Interface (UI) that manages native, BYOK and HYOK keys with a single pane of glass view across regions.
If your job is to staff the cloud administrator role, and your network includes multiple clouds, you have the option of using a centralized cloud key manager and avoiding the need to hire specialists for each of the CSP KMS keys.
Cloud providers try to help customers secure their data, so they sometimes encrypt it, which requires encryption keys. Key management is the general idea of generating keys for encryption and keeping them safe. Key Management as a Service (KMaaS) allows organizations to manage encryption keys more effectively through a cloud-based solution instead of running the service on physical, on-premises hardware. Some cloud providers enable customers to use their own keys, either using BYOK or HYOK.
Google Cloud platform offers both BYOK, with customer-managed encryption keys, or CMEK, and HYOK, with external Key Management [Services] or EKM.
Each cloud service provider (e.g., AWS, Azure, GCP) has their own key management service (KMS) as a convenience for their customers. A cloud service provider’s encryption and key management services are cloud-specific and require the cloud administrator to learn the vocabulary and quirks of each cloud vendor they are using.
A cloud vendor derives data encryption keys internally, from key material the KMS originated, or the cloud vendor can derive the key material from an external source — BYOK or HYOK keys.
To achieve separation of duty, data sovereignty laws and regulatory requirements require the use of BYOK or HYOK keys in certain circumstances.
Using an external KMS enables you to choose a cloud-independent service that can increase efficiency for your cloud native keys. Using the right external KMS can also increase operational resiliency across vendors in the cloud and on premises, and provide BYOK and HYOK keys so that you remain in compliance with data sovereignty laws and regulatory requirements.
|CipherTrust Cloud Key Manager Product Brief|
|CTO Sessions On Demand: Protecting Your Data in Their Cloud|
|CTO Sessions Webcast: A Guide to BYOK and HYOK for AWS, Azure, Google, Oracle and More|
|Microsoft Azure Advanced Data Protection Solution Brief|
|Solution Brief: Best Security Practices for milCloud Data Migration|
|Thales Security Solutions for Google Workspace|
|White Paper: Best Practices for Secure Cloud Migration|
|White Paper: The Case for Centralized Multicloud Encryption Key Management|