Cloud 101CircleEventsBlog
Join us for Cybersecurity Awareness Month! Strengthen your cyber resilience with essential security tips and resources for everyone.

Download Publication

Key Management in Cloud Services
Key Management in Cloud Services

Key Management in Cloud Services

Release Date: 11/09/2020

Working Group: Cloud Key Management

Key management is the management of cryptographic keys in a cryptosystem. A reliable key management system (KMS) helps meet a business’s compliance and data control requirements and benefits the overall security of the organization.


There is little independent analysis and guidance in the public domain for addressing the intersection of key management and cloud services, despite the fact that key management is essential to an organization’s overall cloud security. This document by the Cloud Key Management Working Group attempts to fill this gap. It provides guidance for using KMS in conjunction with SaaS, PaaS, or IaaS cloud services—whether the KMS is native to a cloud platform, external, self-operated, or yet another cloud service. Through this document, you will learn how to meet security and compliance requirements that relate to key management, what the desired outcomes and limitations of encryption are, and which forms of KMS are appropriate for different use cases. Additional recommendations are provided for cloud service providers offering key management functionality to customers.


Key Takeaways:
  • The conceptual architecture of a KMS, including 4 examples of cloud KMS patterns
  • Encryption key management and control, including example controls for the different phases of the key management lifecycle
  • Recommendations for utilizing the 2 most commonly used API architectures in the industry: REST (REpresentational State TRansfer) and SOAP (Simple Object Access Protocol)
  • Practical considerations for API management
  • Features of 5 major cloud service providers’ KMS offerings
Who It’s For: Any cloud providers or cloud customers concerned with key security. This may include CISOs, regulators, developers, architects, security staff, and compliance staff.
Download this Resource

Prefer to access this resource without an account? Download it now.

Bookmark
Share
View translations
Related resources
HSM-as-a-Service Use Cases, Considerations, and Best Practices
HSM-as-a-Service Use Cases, Considerations, and...
Key Management Lifecycle Best Practices
Key Management Lifecycle Best Practices
Recommendations for using a Customer Controlled Key Store
Recommendations for using a Customer Controlled...
Current Challenges with Managing Permissions and API Keys
Current Challenges with Managing Permissions and API Keys
Published: 09/18/2024
What are OAuth Tokens, and Why are They Important to Secure?
What are OAuth Tokens, and Why are They Important to Secure?
Published: 09/12/2024
NIST FIPS 203, 204, and 205 Finalized: An Important Step Towards a Quantum-Safe Future
NIST FIPS 203, 204, and 205 Finalized: An Important Step Towards a ...
Published: 08/15/2024
CSA Community Spotlight: Contributing Something Meaningful with Head of Security Partha Chakraborty
CSA Community Spotlight: Contributing Something Meaningful with Hea...
Published: 08/07/2024
Know Your Exposure: Is Your Cloud Data Secure in the Age of AI?
Know Your Exposure: Is Your Cloud Data Secure in the Age of AI?
November 6 | Online

Acknowledgements

Michael Roza
Michael Roza
Risk, Audit, Control and Compliance Professional

Michael Roza

Risk, Audit, Control and Compliance Professional

Since 2012 Michael has contributed to over 100 CSA projects completed by CSA's Internet of Things, Zero Trust/Software-Defined Perimeter, Top Threats, Cloud Control Matrix, Containers/Microservices, DevSecOps, and other working groups. He has also served as co-chair of CSA's Enterprise Architecture, Top Threats, and Security-as-a-Service working groups while also serving as the Standards Liaison Officer for IoT, ICS, EA, SECaaS, and Cloud K...

Read more

Marina Bregkou
Marina Bregkou
Senior Research Analyst, CSA EMEA

Marina Bregkou

Senior Research Analyst, CSA EMEA

Ashish Kurmi Headshot Missing
Ashish Kurmi

Ashish Kurmi

Paul Rich
Paul Rich
Executive Director, Data Management & Protection

Paul Rich

Executive Director, Data Management & Protection

Paul Rich is the executive director, data management and protection for JPMorgan Chase & Co., where he leads the strategy and implementation within the company for unstructured data protection both in the cloud and on-premises. He is the co-chair of the CSA Cloud Key Management Working Group, which he envisions as a means of hearing diverse perspectives on the use of cloud services and expectations for both data privacy and secu...

Read more

Mike Schrock
Mike Schrock
Senior Director Global Business Development – Cloud Strategy

Mike Schrock

Senior Director Global Business Development – Cloud Strategy

Mike Schrock joined Thales Group (formally Gemalto) in 2015 as the Senior Director, Business Development, managing Cloud Service Provider Strategy. Mr. Schrock is passionate about and has championed digital transformation for over twenty years in his technology alliance and executive management experience, particularly in the digital, cloud and network security, internet and mobile sectors. Prior to joining Gemalto, he held executive roles ...

Read more

Doug Egan
Doug Egan
Director, Cybersecurity and Privacy

Doug Egan

Director, Cybersecurity and Privacy

Doug is a Senior Cybersecurity leader of global IT security, privacy, compliance, service development and management, with over 17 years of global and domestic experience in security architecture, design and compliance, combined with over 20 years in Software Engineering. During his tenure at Computer Sciences Corporation (CSC), Doug led the development of complex managed security solutions, for the entire portfolio of the global Managed Se...

Read more

Subhojit Goswami Headshot Missing
Subhojit Goswami

Subhojit Goswami

Anup Marwaha
Anup Marwaha
Sr Technical Director

Anup Marwaha

Sr Technical Director

Cyber security leader with hands-on experience in enhancing security posture for global Enterprises. Helping DevSecOps achieve enterprise grade key management, to reduce risk & deliver enhanced security solutions. Expertise in addressing needs in the field of digital trust & data protection.

Read more

Christiane Peters Headshot Missing
Christiane Peters

Christiane Peters

Are you a research volunteer? Request to have your profile displayed on the website here.

Interested in helping develop research with CSA?

Related Certificates & Training