Q: What is enterprise key management? What questions should I ask an enteprise key management vendor?
When it comes to protecting sensitive data, it’s fairly common knowledge today that the best way to protect that data is to encrypt it. Companies of all sizes must do this whether they’re taking credit card information, names and addresses, or protected health information. These days encrypting your data is pretty easy. Some operating systems even do it for you, automatically. And if you have a fairly small database of sensitive data that’s stored all in one place, then the key management for your encrypted data is also pretty straightforward.
However, not all networks are so simple. Many times I run into companies who not only store their data on several different operating systems, but they also use several different versions of each system. With such a highly complex network, it can be difficult for IT administrators to easily encrypt all of their sensitive data. They might not even know where their sensitive data is! The complexity of the database infrastructure might be so overwhelming, that implementing an encryption key management system doesn’t even seem feasible.
That’s because these companies don’t just need a key management solution, they need an enterprise key management solution.
Enterprise key management is term being used to today to refer to professional key management systems that provide encryption keys across a variety of operating systems and databases. A network, for example, might be comprised of several different versions of Microsoft SQL Server as well as IBM i, Linux, UNIX, or Oracle servers, as well as backup tapes and data stored in the cloud. The encryption key manager needs to be able to communicate simultaneously with all of these locations in order to provide encryption keys, decrypt, and rotate keys.
Your enterprise key manager (not to be confused with Extensible Key Management, or EKM for Microsoft SQL server) should have high availability and be located centrally in the network, typically in a protected hardware security module (HSM). When looking for an enterprise key management solution, make sure you ask your key management vendor these important questions when assessing their solutions:
- Is your key manager FIPS 140-2 certified? What is the certificate number?
- How would you describe the encryption key payload as retrieved from the key server? Is it simple or complex?
- Is there a common key retrieval application interface on all platforms? What are the differences?
- What platforms do you support for key retrieval? (Note any gaps in platform coverage for your company)
- Do you provide working sample code for the platforms I need? (Windows, Linux, UNIX, IBM i, IBM z)
- Do you supply binary libraries for all enterprise servers?
- Do you have a Java key retrieval class and examples? Is it standard Java or JNI?
- Do you charge separate license fees for each client operating system?
- Do you require that we purchase consulting services from you? Why?
- I am an independent software vendor (ISV), can you brand the solution and certify the solution for us?
For more information on the importance of encryption key management, download our ebook "Definitive Guide to Encryption Key Management Fundamentals" and learn how to overcome the challenges of deploying encryption key management in business applications.
