What are some best practices for enterprise key management?

The NIST establishes standards and regulations such as PCI DSS, FIPS, and HIPAA require organizations to comply with best practices for maintaining the security of cryptographic keys used to safeguard sensitive data. Following are the popular practices.

Use Hardware Security Modules (HSMs): HSMs are physical devices designed to store cryptographic keys and perform cryptographic operations on-site. Stealing keys from an HSM requires physically removing the device from the premises, acquiring a quorum of access cards needed to access the HSM, and bypassing the encryption algorithm protecting the keys. HSMs SaaS is equally effective when the organization owns the key.

Practice the least privilege: Users should only have access to essential keys for their work. This approach ensures better tracking of key usage. If a key is misused or compromised, the number of individuals with access to the key is limited, narrowing down the suspect pool in case of a breach within the organization.

Implement automation: It ensures that keys do not exceed their crypto period or become excessively used. Other aspects of the key lifecycle, such as key creation, regular backups, distribution, revocation, and destruction, can also be automated.

Separate duties: One person may be assigned to authorize new user access to keys, another to distribute the keys, and a third person to create the keys. This division of duties prevents the first person from stealing the key during distribution or learning the key's value during generation.

Avoid hard-coding keys: Hard-coding a key in open-source or any other code grants access to the key value to anyone with access to that code, leading to the possibility of the sensitive data leak.

Quorum Approval: Instead of one individual approving the complete key usage, multiple individuals must come together to validate consent. This ensures peer accountability and mitigates the risk if one portion of the key is compromised.

Enforce policies: Creating and enforcing security policies pertaining to encryption keys is another effective approach many organizations employ to ensure the safety and compliance of their key management system. Security policies define the methods everyone within the organization must adhere to, providing an additional means of tracking who can access certain keys and recording key-related activities.