What is a KMS? Key management throughout the lifecycle

The key is part of the system's security

An encryption key makes encrypted information usable. It therefore needs both protection from unauthorised parties and availability when the organisation needs its data. A Key Management System, KMS, brings together functions for managing that balance.

This can include creating or importing keys, controlling access, monitoring use and managing rotation, deactivation and deletion. The functions actually available depend on the product and its integration with the system that encrypts the information.

Centralised management with clear responsibilities

When each application has its own key management, it becomes difficult to know who owns a key and what happens when an administrator leaves or a system is retired. Shared rules and documented permissions make the work easier to oversee.

• Assign an owner to each use case and separate administration from permission to use keys.
• Describe how keys are created, rotated, backed up and recovered.
• Collect relevant events and decide who follows up on them.
• Test what happens when the key service or the connection to it is unavailable.

KMS and HSM serve different roles

KMS organises key management. An HSM is a dedicated hardware environment for protecting cryptographic keys and performing cryptographic operations. A KMS can use an HSM to protect parts of key management. This does not mean that every application or every data key automatically receives the same protection.

Start with the actual integration

Establish where data is encrypted, which keys are used and whether key material is transferred or temporarily stored. Key material imported into a public cloud represents a different control model from an external key service. Recovery and exit arrangements must also work: a lost key can make remaining backups unusable.

Complior helps design key management for cloud, SaaS and your own environments. Support and responsibilities need to be established for each integration.