Hi All,
Cryptographic operations enable secure communication, access control, authentication, and data encryption at rest. The security of these operations all rely on proper key management. Cloud service providers (CSPs) use key management systems (KMSs) to offer encryption and key management as a service, including functionality such as:
Management operations on symmetric and asymmetric keys, including:
creation
storage
rotation
deletion
Secrets management for:
application programming interface (API) keys
data encryption keys
other service secrets
Some CSPs offer subsets of this key management functionality in multiple service offerings. For the purposes of this cybersecurity information sheet (CSI), the term "cloud KMS" refers to any cloud services that perform any of this functionality.
A cloud KMS integrates with other cloud services to give customers some control over the keys used for cryptographic operations within the cloud tenant. Customers can opt to have CSPs manage some or all features of the KMS. [1] Best practices for a cloud KMS will depend on the boundaries of control over key management desired for each specific use case.
Granting a CSP control over key management inevitably carries some risk. The acceptability of such risks depends on several factors including:
the sensitivity level of the data to be protected
resources available to manage keys on premises
level of trust established with the CSP
U/OO/126065-24 | PP-24-0082 | March 2024 Ver. 1.0 2
NSA & CISA | Use Secure Cloud Key Management Practices
This CSI outlines key management options based on these factors and recommends best practices to consider when using them. With any use of a cloud KMS, it is critical to understand and document shared security responsibilities. Refer to the NSA CSI: Uphold the Cloud Shared Responsibility Model for additional information on the shared responsibility model. [2]
Common key management options for cloud customers
CSPs typically offer several options for key management, with the availability of these options varying between service offerings. Many service offerings provide users the option to perform cryptographic operations using keys the CSP creates and manages. Examples of this would be a cloud storage service that encrypts data automatically or a compute service that encrypts the storage disks with CSP managed keys. The customer has no responsibility for creating or managing the key material and typically has no control over the key length or encryption algorithm used.
On the opposite end of the spectrum, customers have the option to implement their own KMS and cryptographic processes outside of the cloud and encrypt all data prior to uploading it to a cloud storage service. This ensures that even if a malicious cyber actor (MCA) succeeds in accessing a customer's stored data, they would not have access to the keys needed to decrypt the data. However, this method is incompatible with nearly every cloud service. While users can upload encrypted data to storage services, this limits the functionality normally provided by the CSP, such as document search and other analytic capabilities. Other (non-storage) cloud services rely on access to decrypted data to perform their intended functions.
In the middle of the spectrum there are cloud KMS offerings, which let customers take advantage of a CSP's KMS while still being able to choose key types, key sizes, rotation schedules, backup policies, and access controls. A cloud KMS may offer hardware security module (HSM) and/or non-HSM-backed key options. HSM-backed keys are typically generated, stored, and used within the HSM. Depending on the service offering, the HSM may be used to protect only wrapping keys (i.e., keys used to encrypt other keys), or it may protect all customer keys. These services are generally compatible with a range of cloud services.
In some cases, customers can import keys they have created to manage and use in the CSP's KMS, or connect a third party KMS to manage the customer's keys and perform cryptographic operations. Each option has benefits and drawbacks. The best option will depend heavily on the use case.
------------------------------
Michael Roza CPA, CISA, CIA, CC, MBA, Exec MBA, CSA Research Fe
------------------------------