Key & Secrets ManagementWhat is Encryption Key Management?What is Secrets Management? What is a Centralized Key Management System? What is Bring Your Own Key (BYOK)? What is a Credentials Management System? What is Key Management Interoperability Protocol (KMIP)? What is a Symmetric Key? What is an Asymmetric Key? What is Key Lifecycle Management?
Multi-Cloud Data SecurityHow do I move my existing data security controls from On-Prem to the Cloud? How do I protect data as I move and store it in the Cloud? How do I ensure the cloud provider does not access my data?Can I use my encryption keys in the Cloud?How do I enforce data residency policies in the Cloud and comply with GDPR? How do I track and monitor data access and usage in the Cloud? Can I secure containers in the cloud or across different clouds? What is the Shared Security Model? What is multi-cloud key management?
Google External Key Manager Service (EKM)What is Google Cloud’s External Key Manager Service?How does Google Cloud’s External Key Manager work?What are the benefits of Key provenance in Google EKM? What are the benefits of Key centralization in Google EKM?What are the benefits of Key control in Google EKM?How Do You Decide When and How Can Your Data Be Decrypted? What are the requirements when implementing External Key Management? What are the Service integrations and technical considerations in Google EKMWhich GCP services are supported by Fortanix DSM? How Is Google EKM Available with Fortanix Integration? How does international data transfer from Europe work with Fortanix?
AWS External Key StoreWhat is the AWS KMS eXternal Key Store (XKS) service? How does AWS XKS with Fortanix DSM work? What are the benefits of AWS XKS and Fortanix Integration?What are the benefits of Key provenance in AWS XKS?What are the benefits of Key centralization in AWS XKS?What are the benefits of Key control in AWS XKS?Which AWS cloud services are supported by AWS KMS External Key Store? How can AWS XKS integrate with Fortanix DSM? How does international data transfer from Europe work with Fortanix? How does Fortanix DSM as XKS affect KMS service reliability and performance? What is the latency of the XKS service offered by DSM SaaS? Do AWS Services cache Data Encryption Keys serve by AWS KMS? For how long?
How do I move my existing data security controls from On-Prem to the Cloud?
Several cloud vendors offer capabilities to replicate on-premise systems data security to cloud services, allowing the same consistency in data governance and management.
Cloud-native encryption relies on the cloud provider to secure data and is typically offered as the default data encryption scheme. Under this approach, cloud providers generate and own the keys for encrypting data at rest in the cloud. This approach is easiest to implement and has the benefit of integration with other cloud-native services, but it does not offer customers any control or management of the encryption keys. It comes with several security downsides.
Bring your own KMS (BYOKMS) offers one of the most secure ways to protect keys and cloud data while providing strong integration with cloud-native services. Under this approach, a key management service entirely outside the cloud provider's platform generates and manages the master keys used by the cloud provider. The master keys are always securely stored in the customer's off-cloud KMS/HSM. Unlike BYOK, the cloud provider never has access to the master key.
Your Own Encryption is the most secure way to protect keys and cloud data, but it may affect integration with other cloud-native services. This approach provides the same level of protection offered in a data center but with the ease of operations and scalability of the cloud. Customers provide all data encryption keys and perform data encryption in the cloud.
For many organizations, Bring Your Own KMS, and Bring Your Own Encryption are new approaches that can help simplify migrating data to the public cloud and managing multiple cloud data security systems.