As a convenience to their customers, Cloud Service Providers (CSPs) increasingly offer their vendor-specific encryption and key management services. As a necessity for our customers, we offer vendor-independent encryption and key management services. We collaborate and innovate with CSPs and our customers to increase efficiency and operational resiliency across vendors in the cloud and on premises.
We develop products for you, always focused on the fact that as Cloud consumers, you are responsible for the security of your data stored and used in vendor clouds. CipherTrust Cloud Key Management (CCKM) protects your time as well as your data with a single pane of glass view across regions for cloud native, BYOK and HYOK keys and one straightforward UI to manage all cloud Key Management Services.
Separation of Duty:
Enforce separation of duty between your data and your cloud service provider (CSP) by securely storing encryption keys outside of the corresponding cloud.
Mitigate Risks:
Apply risk-appropriate key management controls and workload protection based on sensitivity of the data and compliance mandates.
Across Clouds:
Any combination of public clouds and private or on-prem data infrastructure.
Across Key Sources:
CipherTrust Manager (CM), Luna Network HSM, DSM, Native
Across Key Management Ownership Models:
BYOK, HYOK, Native
Automate key lifecycle management across clouds and hybrid environments with processes and tools.
Processes include:
Key lifecycle management, Data protection
Tools include:
| Amazon Web Services (AWS) KMS | Native | BYOK | |
| AWS CloudHSM | Native | ||
| AWS XKS | HYOK | ||
| AWS China | Native | BYOK | |
| AWS GovCloud | Native | BYOK | HYOK |
| Google Cloud Platform CMEK | Native | BYOK | |
| Google Cloud Platform EKM | HYOK | ||
| Google Cloud Platform EKM UDE | HYOK-CC* | ||
| Google Workspace CSE | HYOK | ||
| IBM Cloud HPCS | Native | BYOK | |
| IBM Cloud Key Protect | Native | BYOK | |
| Microsoft Azure Cloud | Native | BYOK | |
| Microsoft Azure China | Native | BYOK | |
| Microsoft Azure GovCloud | Native | BYOK | |
| Microsoft Azure Managed HSMs | Native | BYOK | |
| Microsoft Office 365 | BYOK | ||
| Oracle Cloud Infrastructure | Native | BYOK | |
| Salesforce.com | Native | BYOK | HYOK** |
| Salesforce GovCloud Plus | Native | BYOK | HYOK** |
| Salesforce Sandbox | Native | BYOK | HYOK** |
| SAP Data Custodian | Native | BYOK |
*HYOK-CC is HYOK for Confidential Computing
**Cache-only Key Service
Digital Sovereignty has three pillars that give you control over your own digital destiny — your data, and the hardware and software you rely on.
Data Sovereignty: You maintain control over encryption and access to your data and comply with the data sovereignty laws by country. Easily demonstrate compliance with privacy regulations such as GDPR, SCHREMS II and PCI-DSS
Operational Sovereignty: Visibility and control over providers’ operations
Software Sovereignty: Run workloads without dependence on a provider’s software
Encryption keys need to be managed whether the data is on premises or in a cloud. “Cloud keys” are encryption keys that enable organizations to secure data at rest with encryption across their cloud workloads without compromise to business functionality. Thales CipherTrust Cloud Key Manager (CCKM) adds controls that simplify and streamline the Cloud Administrator’s job so that organizations can efficiently meet compliance and best-practice requirements by generating, storing, managing and maintaining data encryption keys within a secure environment.
If your job is to administer cloud keys, and your network includes multiple clouds, you are responsible for learning the User Interface and vocabulary for each cloud and managing the different key management systems. You may also be responsible for pulling together a report that lists the expiration date of all the different Cloud Service Provider (CSP) Key Management Service (KMS) keys, being notified X days before the expiration event and rotating the keys before they expire.
If you use Cloud Native keys, you will need to learn and maintain knowledge of each corresponding KMS system. If you choose a centralized cloud key manager, such as CipherTrust Cloud Key Manager (CCKM), you only need to learn one straightforward User Interface (UI) that manages native, BYOK and HYOK keys with a single pane of glass view across regions.
If your job is to staff the cloud administrator role, and your network includes multiple clouds, you have the option of using a centralized cloud key manager and avoiding the need to hire specialists for each of the CSP KMS keys.
Cloud providers try to help customers secure their data, so they sometimes encrypt it, which requires encryption keys. Key management is the general idea of generating keys for encryption and keeping them safe. Some cloud providers enable customers to use their own keys, either using BYOK or HYOK.
Google Cloud platform offers both BYOK, with customer-managed encryption keys, or CMEK, and HYOK, with external Key Management [Services] or EKM.
Each cloud service provider (e.g., AWS, Azure, GCP) has their own key management service (KMS) as a convenience for their customers. A cloud service provider’s encryption and key management services are cloud-specific and require the cloud administrator to learn the vocabulary and quirks of each cloud vendor they are using.
A cloud vendor derives data encryption keys internally, from key material the KMS originated, or the cloud vendor can derive the key material from an external source -- BYOK or HYOK keys.
To achieve separation of duty, data sovereignty laws and regulatory requirements require the use of BYOK or HYOK keys in certain circumstances.
Using an external KMS enables you to choose a cloud-independent service that can increase efficiency for your cloud native keys. Using the right external KMS can also increase operational resiliency across vendors in the cloud and on premises, and provide BYOK and HYOK keys so that you remain in compliance with data sovereignty laws and regulatory requirements.
CipherTrust Cloud Key Management (CCKM) reduces key management complexity and operational costs by giving customers lifecycle control of cloud encryption keys with centralized management and visibility.
As enterprise data and workloads continue to migrate to the cloud, the need to keep sensitive data secure continues to grow. In a recent IDC Data Threat Report study, 50% of all corporate data is stored in the cloud of which 48% of that data is considered sensitive.
Cloud Key Management solutions for AWS can accelerate the ability of organizations to safely migrate sensitive data between AWS and on-premises infrastructures.
Customers using Google Workspace Client-side encryption can achieve stronger security and lower deployment overheads by benefiting from Thales’s integrated end-to-end solution that controls encryption keys separate from their sensitive data in the cloud and protects identities.
Thales collaborates with Google to accelerate safe migration of sensitive data between public cloud, hybrid and private IT infrastructures.
By adding CipherTrust Cloud Key Management, highly-regulated customers can externally root their encryption keys in a purpose-built hardware appliance, or generate their own encryption keys to be used by their SAP applications.
With a significant footprint across the large enterprise community, SAP figures meaningfully in Azure migration discussions – both for the volume of customers that trust SAP applications and for the type of sensitive data they use.