3 Overlooked Areas That Impact Key Management Strategy

You can invest in the strongest perimeter, monitoring tools, and the most trusted providers. But none of it matters if your encryption keys are exposed, mismanaged, or left in the wrong hands.

Attackers know that gaining access to a single key can give them the same privileges as a system administrator.

There’s no shortage of advice—rotate keys, encrypt data, check your logs. But those are table stakes. The difference comes from how well your organization understands and handles the full lifecycle of encryption keys.

This blog covers three aspects of key management that rarely get attention but carry serious risk. And also, it covers the basic questions:

• What specific features should organizations look for in a centralized Key Management System (KMS) to effectively manage encryption keys?
• How can organizations implement location-aware controls for their KMS in a multi-cloud environment?
• What steps should be taken to identify and remediate ghost keys that may already exist in a system?

If you're responsible for data protection, these are the areas worth focusing on.

Ghost Keys in Forgotten Services

Temporary services, test environments, and one-off applications generate their own encryption keys or tap into existing ones. When these systems are decommissioned, the keys are frequently left behind, valid, accessible, and no longer tracked.

These forgotten keys pose a silent threat: they may retain access to sensitive data but fall outside the regular security process.

In March 2025, a hacker named "rose87168" leaked over 10 million records from Oracle Cloud customers. The breach involved stolen Java Key Store files and authentication credentials exposed in a decommissioned environment. The attacker didn’t hack a live system. They just found old keys that still worked.

A centralized KMS helps prevent this by tying each key to a specific service or application and tracking its full lifecycle. When a service is terminated, the corresponding keys can automatically expire or be flagged for review.

The KMS maintains a complete inventory, so no key exists without a known owner, policy, and purpose. This eliminates the risk of ghost keys silently accumulating in your environment.

Key Location and Jurisdiction Conflicts

Many organizations rely on cloud providers across multiple regions but rarely ask where their encryption keys are physically stored or what laws govern them. A key stored in a data center governed by foreign regulations may be legally accessed without your knowledge.

This disconnects between logical control and legal ownership creates risk for sensitive or regulated data.

Under the U.S. CLOUD Act, any U.S.-based cloud provider can be forced to hand over data, including encryption keys, even if that data is stored in Europe.

You may think GDPR protects your data, but if your keys are in a U.S.-controlled system, they could be handed over without you knowing.

In 2020, the Court of Justice of the European Union invalidated the Privacy Shield agreement between the EU and the U.S., making personal data transfers based on the Privacy Shield Decision illegal.

The court said U.S. surveillance laws gave government agencies too much access to personal data, with insufficient privacy protections for EU citizens [Source]. As a solution, a KMS with location-aware controls lets you decide exactly where your keys reside.

You can restrict key storage to specific countries or regions and align with regulatory requirements. Some platforms offer models like BYOK or HYOK, which allow you to retain exclusive access to your keys even when working with global cloud providers.

This setup gives you not just access, but legal and operational control.

Untracked Access by Shadow Admins

Key access isn’t always routed through official admin panels or IAM roles. Developers debugging an issue might copy a key to a local machine, or a DevOps engineer might write a quick script to bypass a policy during an outage. Over time, these informal access paths become normalized and invisible to most audits.

In October 2024, an exposed API key linked to the Internet Archive’s support system allowed unauthorized individuals to retrieve over one million user support tickets, including email addresses and request contents.

The key was not encrypted, yet attackers used it like a direct access pass, sidestepping normal access controls and exposing sensitive user data [source].

A capable KMS closes these gaps with policy enforcement and tamper-proof audit logging. Every access request, successful or denied, is logged with user identity, timestamp, and access method.

Strict access policies ensure only authorized users and services can interact with specific keys under defined conditions. If someone tries to bypass those rules, the attempt is blocked and flagged, helping security teams detect shadow access before it becomes a breach.

Learn more about: Key Management Best Practices

Beyond encryption: Whoever controls the keys controls the data security

This is why you should not let your organization rely on default setups, scattering keys across platforms, or treating them as static files. Key management is central to data security. A strong Key Management System (KMS) gives you absolute control over access, storage, usage, and auditability. It moves encryption from being a formality to something you can trust.

The real question is: Do you know who holds the keys to your data? And can you afford for that not to be you?

Fortanix helps you take back control. Our key management service is a complete security operating system for your encryption keys. Whether you're securing cloud workloads, complying with data regulations, or preparing for a post-quantum world, we can help you get there.

Talk to our team to see how Fortanix can help you secure your keys and data.