Effective Encryption Key Management

Summary of Findings

Analysis

• The Use of the Word "Key" in This Document
• Objectives of Key Management
  • Achieving Expected Security Objectives
  • Avoid Disruptions to Systems and Operations
• Enterprise Key Management
• What It Means to "Manage" Enterprise Cryptography and Keys
  • Summary of Key Management Issues
  • Cryptography Management Hierarchy
  • Key Management and Access Management
  • Cryptography Management and Configuration Management
• Customer Use Cases, Vendors and the Role of Standards
  • Cryptography Silos and Customer Use Cases
• Creating a Cryptography and Key Management Practice
  • Defining Cryptographic Management Policies and Standards
  • Establishing Operational Management and Compliance Procedures
  • Evaluating Cryptographic Technology and Management Solutions
• A Note on Operational and Architectural Security
• Strengths
• Weaknesses
• Governance and Oversight
• Do Not Make Perfection the Enemy of Better
• Evaluate and Implement Key Management Capabilities
• Develop a Cryptography Strategy
• View Key Management as a Practice, Not a Technology
• Know Your Cryptography and Artifacts
• Design for Appropriate Security and Availability Levels
• Make Accountability a Critical Security Objective
• Pay Special Attention to Recoverability of Encryption Keys
• Create Solution-Specific Standards and Processes

The Details

• The Importance of Managing Cryptographic Keys and Other Artifacts
  • The Nature and Life Cycle of Cryptographic Artifacts
  • Relating Confidentiality, Integrity and Availability Objectives of Data to Keys
  • Nonrepudiation Objectives May Require Special Key Handling
  • Accountability Is a Critical Objective in Key Management
  • Identifying Which Keys and Artifacts in the Hierarchy to Manage
• Key Management in High-Assurance Environments

Gartner Recommended Reading