Recommendations for Adopting a Cloud-Native Key Management Service

Description

The purpose of this document is to provide general guidance for choosing, planning, and deploying cloud-native key management systems (KMS). The guidance will provide recommendations that address technical, operational, legal, regulatory, and financial aspects of leveraging a cloud-native KMS. The goal is to optimize business outcomes, including agility, cost, and compliance. It is important to note that adoption of the guidance provided herein cannot ensure that business information is adequately protected when stored, processed or transmitted using public cloud services. This document provides guidance on how to assess and implement cloud key management services with regard to an organization’s needs for key management — it is up to the customer to then use encryption keys (or other artifacts, such as secrets) in ways that follow encryption best practices. Acknowledgments 3 1. Introduction 5 1.1 Purpose 6 1.2 Scope 6 1.3 Target Audience 6 2. Cloud-Native KMS Overview 7 3. Choosing a Cloud-Native KMS.10 3.1 Technical Considerations.10 3.1.1 Hardware Security Module (HSM) Backed Keys.10 3.1.2 General Technical Considerations. 11 3.2 Operational Considerations 13 3.3 Regulatory Considerations14 3.4 Legal Considerations 16 3.5 Financial Considerations . 19 4. Planning a Cloud-Native KMS 21 4.1 Technical Considerations 21 4.1.1 Identity and Access Management 21 4.1.2 Shared Responsibilities 23 4.1.3 Separation of Duties (SOD) 24 4.1.4 General Technical Considerations 25 4.2 Operational Considerations 27 4.3 Regulatory Considerations28 4.4 Legal Considerations 29 4.5 Financial Considerations . 29 5. Deploying a Cloud-Native KMS30 5.1 Technical Considerations.30 5.2 Operational Considerations. 31 5.3 Regulatory Considerations 32 5.4 Legal Considerations.32 5.5 Financial Considerations . 33 6. Conclusion 34 7. References. 35 Appendix A: Acronyms36 Appendix B: Glossary 38