In the first part of this two-part series on Key Management, we saw how an increasing number of organizations are encrypting their sensitive data to mitigate cybersecurity risks. As covered earlier, with cybercriminals getting more sophisticated, merely encrypting data is not sufficient.
With data encryption, the risk is transferred from the data to the encryption keys and to ensure optimal data protection, organizations should make sure that their encryption keys are efficiently managed and safeguarded at each stage of their lifecycle.
In this part, we will cover the various benefits of centralizing your key management and guide you on how to adopt key management for your organization.
Centralized Key Management
When it comes to securely storing the encryption keys, three pertinent questions should be addressed:
1. Where are the keys stored – in third-party applications, in the cloud (private, public or hybrid?), in a heterogeneous environment that supports multiple databases?
2. Are the keys protected with strong access management mechanisms that prevent unauthorised access?
3. Is your approach to key security compliant with the statutory mandates of the regulatory bodies?
As more and more data gets encrypted, the dependence on encryption keys increases and safeguarding all the keys (throughout their entire lifecycle) becomes challenging. The task becomes more daunting in an environment where organizations use diverse vendor systems that generate their own keys.
Further, as encryption keys undergo a lot of changes throughout their lifecycle – like creation, key versioning, distribution, rotation, storage, archival, backup, and ultimately destruction, managing the keys at each juncture of their lifecycle becomes critical.
This is where centralized key management comes handy. With the inherent ability to safely store and manage all the encryption keys centrally in a secure and efficient manner, organizations can uniformly view, control, and administer the encryption keys for all their sensitive data – whether it resides in the cloud, in storage, in databases, or virtually anywhere else.
Leading Key Management Solutions (KMSs) can seamlessly manage keys across heterogeneous encryption platforms and offer extensive support for the Key Management Interoperability Protocol (KMIP) standard, as well as for proprietary interfaces, managing a disparate set of encryption keys becomes easier.
Apart from secure storage and management, another important aspect of centralized key management is key governance. Merely storing and managing the keys is not sufficient but ensuring foolproof access management is equally important. Centralized key management enables proper key governance – even when the data and people move from department to department within the organization.
Requisites for Effective Centralized Key Management
Now that we understand why organizations should adopt centralized key management to ensure optimal data protection, let’s look at the three important requisites for centralized key management to work smoothly:
1. Key Management Server
At the heart of any good Key Management Solution is a FIPS 140-2, Level 3-certified intrusion-resistant, tamper-proof hardware server (also known as a Hardware Security Module or HSM) that plays the important role of creating, storing, retrieving, rotating, archiving and deleting the encryption keys.
This server also facilitates seamless communication with all other applications (both internal as well as external) through native encryption using the Key Management Interoperability Protocol (KMIP).
Below are three important points that organizations should consider while selecting a key management server:
(1) Adherence to Regulatory Compliances
The server must comply with federal security requirements that mandate the destruction of all the stored encryption keys upon detection of a forced entry.
(2) Role Management
The server should have in-built role management features that provide separation of duties between various user roles with handy tools to quickly assign/delete roles. As more and more data gets encrypted leading to an increasing dependence on encryption keys, role management becomes a crucial feature for any organization.
(3) Interoperability
The server should be able to coherently interoperate with other business applications by providing access to its user interface through APIs, web services and encryption connectors.
As a best practice, organizations should:
(a) Store all encryption keys (and not just the Root of Trust Master Key) in the hardware server.
(b) Ensure that the autorotation and versioning of keys take place as per a pre-defined schedule without any downtime during the key rotation process, and
(c) Ensure that the whitelisting of the IP address happens within the secure hardware server itself.
2. Key Management Policies
As seen in our previous post, a key management policy (KMP) is a pre-defined set of rules that cover the goals, responsibilities, and overall requirements for securing and managing an organization’s encryption keys.
While a key management server can centrally manage all the encryption keys and enforce set policies, it cannot create a KMP on its own. The onus of chalking out a comprehensive KMP lies with the organization’s Cybersecurity & IT Heads, like the Chief Information Security Officer (CISO), Chief Risk Officer (CRO), etc. who are responsible for ensuring the adoption of KMPs for data protection. ‘Unambiguity’ is one of the most important pillars of a good KMP that makes sure that there are no misinterpretations whatsoever while accessing the encryption keys. For example, a KMP can unequivocally state that the employees of one business unit or department cannot access the encryption keys of another unit, or that access to the keys can be granted only through the corporate LAN.
3. Key Management Processes
Key management processes are a host of diverse processes like inputs, activities, and outputs that are pivotal to centralized key management.
These processes help users in using their organization’s KMP and can be automated or implemented manually. For example, depending on the sensitivity of the data to be accessed, the Key Management Process may instruct users to either connect through a VPN or through the corporate LAN.
How Gemalto Helps in Centralizing Key Management
As the global leader in enterprise key management, Gemalto’s SafeNet KeySecure is widely adopted by organizations across the globe to centralize manage their encryption keys.
Available as a hardware appliance or virtual security appliance, SafeNet KeySecure is a plug-and-play, secure centralized key management platform that can be quickly deployed in physical, virtualized infrastructure and public cloud environments.
Holistically supporting data encryption and key management of a diverse set of databases like Oracle, IBM DB2, Microsoft SQL, Mongo DB, etc., SafeNet KeySecure also seamlessly supports the generation, storage and exporting of keys in a Bring-Your-Own-Key (BYOK) environment from cloud players like Microsoft Azure, Amazon Web Services, etc.
Below is a quick snapshot of the diverse integrations ecosystem that Gemalto’s SafeNet KeySecure supports:
For organizations that have already invested in HSM devices, Gemalto offers a cost-friendly Virtual Key Management Solution – SafeNet Virtual KeySecure that centralizes all cryptographic processing and provides scalable key management at remote facilities or cloud infrastructures such as VMware or AWS Marketplace.
To Sum It Up
With rising incidents of cyber attacks and data breaches, neither front line defense mechanisms suffice, nor does mere data encryption. To safeguard sensitive data, organizations should not only secure their encryption keys from unauthorized access, but also efficiently manage them centrally through a state-of-the-art, highly scalable key management solution. Learn more about Enterprise Key Management and how it can help your organization efficiently manage your encryption keys.
The post Understanding Key Management Policy – Part 2 appeared first on Cybersecurity Insiders.
May 23, 2019 at 09:09PM
0 comments:
Post a Comment