Implementing CCM: Cryptography, Encryption, and Key Management

The Cloud Controls Matrix (CCM) is a framework of controls (policies, procedures, and technical measures) that are essential for cloud computing security. It is created and updated by CSA and aligned to CSA best practices.

You can use CCM to systematically assess and guide the security of any cloud implementation. CCM also provides guidance on which actors within the cloud supply chain should implement which security controls. Both cloud service customers (CSCs) and cloud service providers (CSPs) use CCM in many ways.

CSCs use CCM to:

• Assess the cloud security posture of current or potential cloud vendors. If a cloud vendor isn’t transparent about their security controls, the risk of doing business with them can be quite high.
• Compare vendors’ level of compliance with relevant standards like ISO 27001.
• Clarify the security roles and responsibilities between themselves and the CSP.

CSPs use CCM to:

• Assess, establish, and maintain a robust and internationally accepted cloud security program. CCM helps solidify CSPs' positions as trusted and transparent providers of cloud services.
• Compare their strengths and weaknesses against those of other organizations.
• Document controls for multiple standards in one place. CSA has mapped the controls in CCM against several industry-accepted security standards, regulations, and control frameworks.

CCM contains 197 control objectives structured into 17 domains that cover all key aspects of cloud technology:

 

CCM Domains

 

Today we’re looking at implementing the fifth domain of CCM: Cryptography, Encryption and Key Management (CEK). The CEK domain consists of 21 control specifications:

1. Encryption and Key Management Policy and Procedures
2. CEK Roles and Responsibilities
3. Data Encryption
4. Encryption Algorithm
5. Encryption Change Management
6. Encryption Change Cost Benefit Analysis
7. Encryption Risk Management
8. CSC Key Management Capability
9. Encryption and Key Management Audit
10. Key Generation
11. Key Purpose
12. Key Rotation
13. Key Revocation
14. Key Destruction
15. Key Activation
16. Key Suspension
17. Key Deactivation
18. Key Archival
19. Key Compromise
20. Key Recovery
21. Key Inventory Management

The CEK domain focuses on safeguarding CSCs’ data through cryptographic techniques, encryption, and effective key management. It plays an essential role in ensuring compliance with encryption standards and maintaining the confidentiality and integrity of sensitive information in cloud environments.

Under the Shared Security Responsibility Model (SSRM), CSPs govern cryptography, encryption, and key management practices. They ensure these practices align with industry guidelines and regulatory standards. They manage the underlying infrastructure, provide secure key storage, and deliver encryption services. 

Meanwhile, CSCs take responsibility for encrypting their own sensitive data before uploading it to the cloud. They also manage their encryption keys and assign roles and responsibilities within their applications and data. Finally, they oversee cryptographic risk and change management processes specific to their environment

Below, learn more about applying the SSRM to CEK controls and using these controls in a real-life setting.

 

Understanding the Controls

The CEK domain consists of 21 control specifications that apply to the entire lifecycle of protecting customer data. You can divide these controls into three main categories. The categories cover the entire spectrum of cryptographic operations and cloud environments. 

The first category is Data Encryption. It includes controls for data encryption and specifying encryption algorithms. The second category is Policy and Governance, which covers crucial areas like encryption, encryption policies, roles and responsibilities, change management, risk management, and auditing. Lastly, the Key Lifecycle Management category includes controls for key generation, rotation, revocation, destruction, and capabilities for customer management.

 

Implementing CEK Controls Under the SSRM

The CEK controls help both CSPs and CSCs protect relevant data and comply with data protection laws and regulation. However, there's a clear division of responsibility for who should do what.

In general, CSPs are responsible for the security of the cloud itself. They provide capabilities for secure data, storage, access, and disposal. CSCs are responsible for security in the cloud, protecting the data that they store or process in the cloud.

CSPs are responsible for aligning their security services with industry best practices and regulatory requirements. They also offer compliance frameworks and tools, conduct assessments, and keep the cryptographic system up to date. The CSP provides the security foundation for CSCs to use. 

CSCs then need to actively engage with the tools and services provided by the CSP. This starts with the CSC defining roles and responsibilities for cryptography and key management within their organization. CSCs are also responsible for encrypting sensitive data before uploading it to the cloud.

Two shared controls are especially important to keep in mind: Data Encryption and CSC Key Management Capabilities. These are important because they require collaboration between the CSP and CSC. For example, while the CSP provides encryption capabilities, the CSC must properly implement and manage encryption for their data. And for the CSC Key Management Capabilities control, the CSP provides the capabilities, but the CSC is responsible for implementing those capabilities to protect their sensitive data.

 

HIPAA Example

Imagine a healthcare analytics startup that is making waves in the industry. They're using a single cloud platform to store and analyze patient data from multiple hospitals. 

This startup is doing some things right: They use CSP-managed encryptions. They rotate their keys on an annual basis. They've logically segregated customer data into separate databases. 

Despite these measures, there are several significant data security risks as well.

The company is using a single encryption key for all their data. This creates a single point of failure. When someone compromises the key, all customer data is at risk. Moreover, annual key rotation might not be frequent enough for such sensitive PHI data. 

Next, they have the issue of inadequate data isolation. While the company has logically segregated the data, they lack customer-specific encryption controls. This not only presents a security risk, but also makes it challenging to prove data segregation to auditors. Speaking of compliance, this setup potentially falls short of HIPAA and HITRUST requirements.

So how do they address these risks? They can start with CEK Controls 2 and 3: CEK Roles and Responsibilities and Data Encryption. Next, CEK 4 ensures they are using appropriate encryption algorithms. CEK 12 addresses key rotation and CEK 8 focuses on key management capabilities used by the customers.

So, this healthcare analytics startup needs to use customer-managed keys for each client database. They should rotate these keys bi-annually, at least for PHI data.

Next, they need to establish robust role-based access controls and maintain detailed audit logs. This addresses both security and compliance concerns.

Third, they need to ensure strong encryption for data at rest and in transit.

Fourth, they need to align their practices with HIPAA and HITRUST. This isn't just about ticking boxes, it's about creating a comprehensive compliance security posture.

Finally, they need to implement continuous monitoring and regular security assessments. They cannot afford to be reactive with their security.

 

Conclusion

Implementing cloud security isn't a one-time task, but an ongoing process. CSPs and CSCs must understand both their shared and individual responsibilities. Remember, effective cloud security balances control, convenience, cost, and compliance. By applying these principles, you are not just securing data, you are enabling your business to thrive in the cloud. 

Download and review the Cloud Controls Matrix and CCM Implementation Guidelines. Explore these free resources and begin to develop successful encryption and key management strategies for your organization.

Learn more about implementing CCM by checking out the other blogs in this ongoing series. Be on the lookout for the next installation: Data Security and Privacy Lifecycle Management.