The Business Case for Enterprise Key Management

How an enterprise key management system can prevent data breaches, produce efficiency savings, simplify compliance, and enable digital transformation.

Ensuring the security of sensitive data has become a top priority for organizations of all sizes. The effective management of encryption keys is crucial in protecting data from unauthorized access. However, managing keys in a hybrid or multicloud enterprise can be a complex and challenging task, especially when dealing with a large number of keys. Encryption is easy, but key management is hard.

This blog post explains how consolidating and centralizing enterprise key management operations can benefit organizations. This article is intended for anyone involved in data protection, cloud security, cryptography, and managing enterprise keys.

Key Management Concepts

Key management is the practice of administering the lifecycle of cryptographic keys in accordance with best practices.

NIST Special Publication 800-57 Part 1, Revision 4 “Recommendation for Key Management” states:

“The proper management of cryptographic keys is essential to the effective use of cryptography for security. Keys are analogous to the combination of a safe. If a safe combination is known to an adversary, the strongest safe provides no security against penetration. Similarly, poor key management may easily compromise strong algorithms. Ultimately, the security of information protected by cryptography directly depends on the strength of the keys, the effectiveness of mechanisms and protocols associated with the keys, and the protection afforded to the keys.”

Thus, we can see that the fundamental requirements of key management are to:

• Generate cryptographically strong keys.
• Protect the keys against disclosure or alteration.
• Provide effective controls for managing and using keys.

What is a Key Management System (KMS)?

Encryption is built into many products today, sometimes with rudimentary capabilities for generating and storing keys, but they generally fall far short of meeting the expectations of NIST SP 800-57. Hence, electronic key management systems are commonly used to support the management of keys in accordance with best practices and to ensure data security.

A major element of any KMS is its ability to systematically manage keys over their entire lifecycle: key generation, key import/export, key distribution, key usage, key update, key backup, key revocation, and key deletion.

In addition, a KMS should provide controls to ensure that keys can only be accessed by authorized individuals and systems, used only for their intended purposes, and that all key operations are logged for audit and compliance needs.

As a business-critical system, another important aspect of any KMS is to ensure that keys are always available when and where required, and that they are fully protected against permanent loss (whether accidental or malicious).

The Need for Enterprise Key Management Systems

Large organizations typically have many different tools and systems for managing keys across different parts of their infrastructure, not to mention within public clouds. This can be a natural result of organic growth, mergers and acquisitions, and the incremental deployment of encryption to meet security standards such as ISO 27001 and privacy regulations such as General Data Protection Regulation (GDPR) or California Consumer Privacy Act (CCPA).

However, not only is this inefficient, but it also makes it very difficult to apply consistent policies and controls across the organization and to undertake compliance audits. Many organizations will admit that they don’t know where all their keys are, who has access to them, what they are used for, whether they are updated regularly, or when they were last used. This is a data breach waiting to happen! The compromise of even a single key could be devastating in terms of fines, recovery costs, and reputational damage.

The solution is to replace this fragmented key management ecosystem with an enterprise key management system (KMS), i.e., a single, centralized KMS for the entire enterprise encryption. As such a tool must support many use cases within the organization, it must be both powerful and flexible.

The 11 essential capabilities of an enterprise KMS are:

1. Broad range of enterprise encryption key types/lengths supported to achieve compliance requirements and support applications.
2. Use of a certified hardware random number generator to generate keys.
3. Multi-layer security mechanisms including hardware-level protection to safeguard keys.
4. High-availability and DR capabilities to protect the availability of keys for mission-critical systems.
5. Logical access controls with strong authentication and configurable permissions to secure key access.
6. Quorum policies to protect against rogue employees and insider threats.
7. Automation of common tasks such as key rotation.
8. APIs to integrate with target systems. (e.g., KMIP, PKCS#11, REST)
9. Tamper-proof audit log for compliance audits.
10. Integration with existing enterprise tools. (e.g., LDAP, SSO, SIEM)
11. Agility to adapt to changing technology, such as quantum computing.

Benefits of an Enterprise KMS

There are many benefits of using an enterprise KMS, as detailed below.

Risk Reduction
An enterprise KMS enhances the organization’s security posture by preventing the loss, compromise, and misuse of keys:

• Ensures the use of cryptographically strong keys.
• Provides protection against theft of keys.
• Enforces logical access controls.
• Reduces the scope for human errors.
• Provides secure communication channels and APIs for key distribution.
• Automates rotation of keys.
• Manages revocation or deletion of keys at the end of their life.
• Provides signed audit logs for compliance and forensic investigations.
• Supports post-quantum algorithms.

Efficiency and Cost Reduction
An enterprise key management plan must create many opportunities for increasing efficiency and reducing cost:

• Eliminates costly manual processes.
• Reduces the number of skilled resources required to manage enterprise keys.
• Provides the ability to automate processes.
• Scales along with the organization’s needs.
• Simplifies compliance audits.
• Reduces the risk of key compromise and the associated costs.

Compliance
Data protection is now a boardroom issue. Organizations must comply with numerous regulations such as PCI-DSS, GDPR, CCPA, SOX, HIPAA, and many others, not to mention internal governance policies and standards which are commonly based on national or international standards such as FIPS or ISO.

Encryption and tokenization are primary methods of protecting data but are only effective if the associated keys are properly protected and managed. An enterprise KMS enables organizations to easily maintain and demonstrate adherence to standards, policies, and regulations.

Encryption includes an algorithm and a set of keys to transform the original data into an unreadable format, which can only be decoded by authorized parties who have access to the decryption key.  

Tokenization utilizes format-preserving encryption to transform part or all of the data while retaining the original format. This tokenized data retains its utility for transactional or analytical purposes while preventing the reconstruction of the original sensitive information.

Outlined below are three major benefits of tokenization:

• Mitigate data breach risks: Tokenization reduces the needs to store sensitive data, reducing the vulnerability to data breaches. 
• Streamline compliance: Tokenization helps organizations adhere to regulatory requirements by ensuring that sensitive data remains encrypted. 
• Facilitate scalability: Tokenization helps organizations expand their operations by simplifying the handling of substantial quantities of sensitive data.

An enterprise KMS (Key Management System) provides a centralized platform for generating, securely storing, managing, and distributing encryption and tokenization keys to authorized parties, enabling organizations to maintain control over their sensitive data and demonstrate adherence to standards, policies, and regulations. 

Flexibility and Agility
Today’s competitive pressures are forcing organizations to be more flexible and agile, which often means moving applications and storage to the public cloud. With this comes new security and compliance challenges, as well as new ways of working – e.g., Continuous Integration / Continuous Delivery (CI/CD). To enable a secure-by-default DevSecOps approach, developers must be able to utilize cryptography easily via a REST API that supports the on-demand creation and utilization of keys and digital certificates.

Building the Business Case for an Enterprise KMS

The benefits of using an enterprise KMS are clear, so building the business case to invest in such a solution is relatively straightforward.

The first step is to recognize the limitations and risks of continuing without enterprise key management systems. Perhaps the organization has one or more old key management systems, perhaps even built in-house, which once met the organization’s needs but are no longer adequate or effective in the face of today’s security, efficiency, compliancy, or agility demands. Consider the cost of operating and maintaining such systems and the risk of a data breach should a key be compromised.

The second step is to identify the main driver for change, which will depend on where the organization sees the greatest challenge and how to overcome it through key management solution:

• Data Breach Prevention - If there are known security gaps, and data breaches are a concern, then risk reduction may be the main justification for deploying an enterprise KMS. The business case will offset the cost of the solution against the cost of a data breach, which could result in fines, lawsuits, and reputational damage that could cost the CEO their job and even destroy the company. The chosen solution should have a strong underlying security architecture and meet industry standards such as FIPS 140-2.

• Cost Savings - Efficiency and cost-control is another common driver. Consolidating key management operations is more cost-effective in terms of both tools and people and can provide a significant return on investment (ROI). The chosen solution should be flexible enough to support not only the existing use cases, but also scale to meet future capacity demands, support new technologies, and adapt to changing business requirements going forwards.

• Audit Findings - If the organization has failed internal or external compliance audits, then this can be a strong justification for an enterprise KMS, which enables standardization and enforcement of policies and controls and provides evidence in the form of an audit log that can be recorded and analyzed using SIEM tools. The chosen solution should provide the necessary tools to enable the organization’s policies to be enforced and provide detailed audit logs.

• Cloud Migration - If the organization is looking to make greater use of cloud technology, and in particular hybrid- or multi-cloud, then this requires a modern, cloud-friendly enterprise KMS solution that is cloud-agnostic, supports DevOps / DevSecOps methodologies, and offers a comprehensive REST API, while still supporting legacy on-premise applications.

An enterprise key management system should be seen as a strategic enterprise tool that enables the organization to unlock the power of its data by securing it throughout its lifecycle. By enhancing security, eliminating inefficiency, simplifying compliance, and enabling business transformation, the ROI can be very significant and rapidly cover the initial investment cost, with savings continuing to accrue over time.

Conclusion

Proper key management is critical for security and compliance. Enterprise key management is the only way to effectively and efficiently secure keys and the data they protect, while supporting the demands of digital transformation.

The procurement of an enterprise KMS is a strategic decision that the organization will have to live with for many years. So, making the right choice is critical. This article highlights some of the technical and functional considerations that should be considered when choosing an enterprise KMS for managing enterprise keys, but it is also important to consider the vendor’s ability to innovate and support emerging trends such as DevSecOps and post-quantum cryptography.

To learn more about the Fortanix DSM, request a demonstration.