Bring Your Own Encryption, Bring or Hold Your Own Key, Secure Identity Verification
Information technology workloads in Google Cloud can deliver both convenience and cost savings. However, you still need to follow security, privacy and compliance rules, as well as best practices, for protecting data. Further, you need rapid data mobility across all clouds you currently use and those in your future, a need which can be compromised with cloud-vendor-specific encryption solutions. And, as one of the few hyperscaler cloud service providers, Google Apps qualify Google as both an IaaS/PaaS and SaaS provider. And the best way to protect SaaS is with comprehensive identity verification.
While Google Cloud encrypts all customer data at rest, Thales and Google have forged a relationship to help Google Cloud customers further protect their sensitive information. The solutions discussed here are part of the Thales and Google Cloud relationship.
Thales recognized as Partner of the Year in the
Security – Data Protection category
To fulfill the shared responsibility model for cloud security, choose Bring Your Own Key (BYOK), Hold Your Own Key (HYOK), or mechanisms to discover sensitive data and Bring Your Own Encryption (BYOE). In addition, you need external policy-based access management with smart single sign on (SSO) and multifactor authentication (MFA).
Thales supports both Customer-Managed Encryption Keys (CMEK) and External Key Management Services (EKMS):
Use technology that enables you to find and classify sensitive data subject to data privacy or protection mandates worldwide and then protect and control the data with advanced encryption and policy-based access management. Or you can architect applications to be cloud-native and protect data using vaultless tokenization with dynamic data masking.
Locate regulated data with streamlined workflows that help eliminate security blind spots. Built-in discovery and classification templates offer a quick start with the flexibility needed to create new policies. Detailed reports can demonstrate compliance with rules, regulations and laws. Discover CipherTrust Data Discovery and Classification.
Realize a fast return on investment with CipherTrust Transparent Encryption. Protect data without changes to applications, databases, infrastructure, or business practices. Google Storage solutions encrypt all data at rest but deliver data in the clear to operating systems. Most data thefts are due to compromises in the operating system, applications, or distracted users. OS-level controls combined with granular access policies give you the protection your sensitive data requires.
Cloud native applications might not have operating systems on which to run Transparent Encryption. Secure your data in cloud native applications with:
Luna HSMs support the Google Customer-Supplied Encryption Keys (CSEK) and Google Cloud EKM service. For convenient access to encryption key quality and ownership, Thales Data Protection on Demand (DPoD) provides a wide range of Luna Cloud HSM and CipherTrust Key Management services through a simple online marketplace. Several DPoD-based services are available on the Google Marketplace: Luna Cloud HSM, a general-purpose HSM solution supporting ISV and customer-written applications, and, the CipherTrust Key Broker for Google EKM that enables secure creation and control of encryption keys outside of the Google Cloud environment.
It is important to not be locked into a single cloud vendor. We recommend you choose an IDP that supports multiple clouds, so when your business needs change -- you aren’t locked in to a single cloud vendor.
STA provides the ability to securely deploy an access management solution across an organization’s entire environment, across all operating systems and clouds.
STA protects cloud resources at the log in point by using authentication and conditional access, and enforcing policy-based access controls every time a user logs into an app. Read more about SafeNet Trusted Access.
STA supports 2FA and can be configured to support multi-factor authentication (MFA) in Google Cloud.
STA improves productivity for IT administrators and customers without decreasing security by providing support for Cloud Single Sign On (SSO) and MFA in Google Cloud.
SafeNet Trusted Access (STA) is a cloud-based service that acts as the trusted identity provider (IDP) for Google Workspace and other third-party cloud and web-based apps. As an IDP, STA provides IT administrators with the ability to easily deploy an access management solution across their entire environment, including multiple clouds.
STA secures access to Google Workspace and authenticates user identities across:
In minutes, STA enables you to set policy-based access for SSO and 2FA/MFA for all your cloud and web apps.
Enterprise customers can have full control over their encryption keys by combining SafeNet Trusted Access and CipherTrust Cloud Key Manager.
Adhering to the concept of “shared responsibility for cloud security”, Google recommends that customers use both an external key manager (EKM) and Identity Provider (IDP) to ensure that only authorized and authenticated individuals can access protected documents. Only Thales develops both an independent IDP and key management solution.
In a world of digital transformation and cloud-based apps, cloud providers and enterprises are looking for stronger cloud security and compliance. Addressing this challenge, Google Workspace now provides enhanced privacy and confidentiality options with Client-side encryption–...
The transition of moving workloads and applications to the cloud is frequently spearheaded by leveraging cloud-based collaboration suites such as Google Workspace. While offering immense benefits in terms of easy, anywhere access from any device, recent lateral attacks within...
