Managing Key Infrastructure

Encrypting your data may be the most critical of all the security measures you take in your environment. Once data is encrypted, only those with authorization to use the key that decrypts the data may access those files and pieces of information to read and view their contents.

As a security professional, you are often the one that others in the organization come to with questions on how to facilitate data encryption using the company’s standards. This is why it’s essential that you are familiar with the workings of Key Management Service (KMS) and the API calls that encompass this service.

Throughout this chapter, you will gain basic knowledge of encryption and a substantial understanding of the services that manage and provide encryption for AWS accounts and environments. This will allow you to manage, rotate, and protect encryption keys and ensure that data is being encrypted.

Note

With the AWS Certified Security Specialty exam...

Technical Requirements

You require an active AWS account and the ability to create a KMS key and a new CloudHSM cluster. This means that if you do not own the account in which you are performing the practice exercises, then you will need an IAM role attached to your user that allows the creation, manipulation, and deletion of KMS keys. You will need a VPC with multiple Availability Zones to set up the CloudHSM cluster.

A Basic Overview of Encryption

In today’s world, data protection and privacy are of the utmost importance, not just to individuals but also to large organizations dealing with customer data on a large scale. When data is not encrypted, that data is considered plaintext, meaning that anyone who has access to the data can view it without any restrictions. If none of this data is sensitive, then storing it in plaintext form is not an issue. However, if the data contains sensitive or confidential information, it should be encrypted.

Encryption is the process that ensures the confidentiality and security of sensitive data. It involves transforming data into an unreadable format using an encryption algorithm and a cryptographic key. This makes the data unintelligible to unauthorized parties, protecting it from unauthorized access and interception.

Encryption provides a critical layer of protection for sensitive data, such as customer information, financial data, and trade secrets...

Working with AWS KMS

Before you start to review KMS in depth, you should first become familiar with the different components of the service and how they interact with each other. The following is a list of components that you should have a complete understanding of. They are explained in detail in the following sections:

• Customer Master Keys
• Data Encryption Keys
• Key Material
• Key Policies
• Grants

Customer Master Keys

Customer Master Keys (CMKs) are an essential component of KMS as they contain the key material for both encrypting and decrypting data.

Think of the CMK as a keychain that holds the keys to lock and unlock your valuable belongings. In this case, the belongings are your data, and the keys represent the cryptographic information needed to secure the data.

The CMKs are created and managed within KMS and provide a secure and convenient way to generate and control encryption keys. Encryption keys act as the guardians of your sensitive data...

Cross-Region Key Management

While having the ability to create and manage KMS keys on a one-by-one basis is a useful feature to have, either through the AWS Management Console or programmatically from the CLI, once your accounts start to spread out geographically, keeping track of which keys encrypt items in which regions can become burdensome. Luckily, AWS has listened to customer feedback and has introduced functionality in KMS that allows users like yourself to replicate a KMS key from one region to another.

There are some best practices that you should be aware of when starting to manage your KMS keys across multiple regions:

• Turn on the KMS multi-Region replication: KMS provides the option to enable multi-region replication for customer master keys. By enabling this feature, KMS automatically replicates your CMKs to other regions, allowing you to use the same CMK for encryption and decryption in different regions.
• Choose a primary Region for creating and managing...

Checking the Compliance of KMS keys with AWS Artifact

Depending on your line of business or the types of compliance and regulations your organization needs to deal with, you may need to check if the encryption you use with KMS meets the compliance standards. Further, meeting compliance standards doesn’t just concern the encryption service you’re using but all the AWS services you use in your solution. So, where do you find the answers to questions about compliance quickly and easily?

AWS Artifact is a service that provides a central repository of AWS compliance-related documents and agreements. It provides easy access to various documents, including security and compliance reports, certifications, and service-specific agreements.

The AWS Artifact service aims to streamline and simplify the process of understanding and assessing the security and compliance posture of AWS services. It consolidates many required documents for compliance audits, assessments, and due...

Exploring CloudHSM

AWS CloudHSM is another managed service for data encryption. Being fully managed, many aspects of implementing and maintaining the HSM are abstracted, such as hardware provisioning, patching, and backups. CloudHSM also has the great advantage of automatically scaling on demand.

HSM stands for Hardware Security Module. It is specialized security hardware validated to FIPS 140-2 Level 3. HSMs can be used to generate and create your own encryption keys.

CloudHSM is required when you and your organization warrant additional control and administrative power over your encryption compared with KMS. Although KMS is supported by its own FIPS-enabled HSM, you have no control over those modules. Further, AWS cannot access your keys or any cryptographic material within your HSMs.

With certain compliance and regulatory requirements, you will be obliged to use an HSM to generate your keys or an HSM might be required to be used as a cryptographic key store. In addition...

Summary

In this chapter, you looked at the leading service for encrypting data at rest in AWS, Key Management Service, or KMS. You were given a basic introduction to encryption, and the difference between symmetric and asymmetric encryption keys was explained. You learned all about the major components of the KMS service: customer-managed keys, data encryption keys, key material, key policies, and grants.

You saw how the AWS Artifact service can help you check the compliance of the KMS keys you are using and the compliance of other services. You also learned how AWS Artifact is a self-service document repository that can help you with auditing or if you need to look up something that could be found in the customer agreement.

In Chapter 13, Access Management, you will review a new section regarding IAM. This section will begin with access management and discuss how you can allow users access to your systems natively with the IAM service, along with creating groups of users.

...

Further Reading

For additional information on the AWS shared responsibility model and an underlying foundation to AWS security, please look at the following resources:

• AWS KMS FAQs: https://packt.link/kK77E
• Demystifying KMS keys operations, bring your own key (BYOK), custom key store, and ciphertext portability: https://packt.link/Y2jb9
• AWS KMS Best Practices (whitepaper): https://packt.link/5fsOY
• AWS CloudHSM FAQs: https://packt.link/IbDTH
• AWS Artifact FAQs: https://packt.link/jjdei

Exam Readiness Drill – Chapter Review Questions

Apart from a solid understanding of key concepts, being able to think quickly under time pressure is a skill that will help you ace your certification exam. That is why working on these skills early on in your learning journey is key.

Chapter review questions are designed to improve your test-taking skills progressively with each chapter you learn and review your understanding of key concepts in the chapter at the same time. You’ll find these at the end of each chapter.

How To Access These Resources

To learn how to access these resources, head over to the chapter titled Chapter 21, Accessing the Online Practice Resources.

To open the Chapter Review Questions for this chapter, perform the following steps:

1. Click the link – https://packt.link/SCSC02E2_CH12

   Alternatively, you can scan the following QR code (Figure 12.18):

Figure 12.18: QR code that opens Chapter Review...