Key Management Strategies In The Cloud Part 4:Treat Your Cryptographic Keys As More Than Just Data

As the final in a series of posts on key management in the Cloud, following are the remaining three possible strategies that organisations could look to adopt when thinking about how to secure their information in the Cloud.

The Just In Time Strategy is where keys and sensitive materials are stored on premise, only being released into the Cloud for a short time when needed. Quite a few companies are starting to offer such solutions with a large on-premise management system and a small software plugin for the Cloud applications which can fetch and use keys when needed. This is a promising model but it’s early days: watch out for highly proprietary systems, vendor lock-in and the need to modify applications directly to take advantage of the solution. And remember - the keys have still been exposed to the Cloud, no matter how briefly.

Next we have what I call the Mole Strategy, because you use tunnels. This is the logical conclusion of hybrid systems and provides a solution to the exposure issues of JIT. With a trusted hardware lynchpin or suitable access to a user-controlled secure element in the cloud, you can assert some control over key management by connecting to a trusted island in a whole sky of Cloud. This is not yet a reality but for security-conscious users it would be a real boon.

Finally, we have the Big Brother Strategy. Sometimes overlooked, the deterrent effect of strong auditing and oversight should not be underestimated. The use of hardware devices, cryptographic signatures and independent access control for audit keeping can vastly improve the trustworthiness and reliability of a log and provide an added deterrent. While this approach cannot prevent an event from happening it does provide excellent visibility which enables the organisation to make informed risk decisions about what data they can trust in the Cloud.

Whichever strategy you choose for your move to the Cloud, remember that your cryptographic keys are more than data, they are your promises. Keep them well.