When keys are held in an external key manager, every encrypt and decrypt request depends on a network path to, and the correct operation of, infrastructure outside the provider. Loss of that path or of the external system halts all operations with those keys, and compromise of the external system exposes the key material or the plaintext data keys that pass through it. Availability of every workload that depends on the keys and confidentiality of the data they protect are affected.
External Key Store is Unavailable or Compromised
CCC.KeyMgmt.TH09
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.KeyMgmt.CP27 | External Key Store | The service may be configured to perform cryptographic operations with keys held in a key manager outside the provider's infrastructure, so that the user retains sole custody of the key material. Where a provider lacks this, key material custody cannot be kept outside the provider. |
| CCC.KeyMgmt.CP09 | Encrypt Data | The service can encrypt data submitted by a user with a managed key and return the ciphertext without exposing the key material. |
| CCC.KeyMgmt.CP10 | Decrypt Data | The service can decrypt ciphertext submitted by a user with a managed key and return the plaintext without exposing the key material. |
Related Controls
| ID | Title | Description |
|---|---|---|
| CCC.KeyMgmt.CN10 | Alert on External Key Store Failures | Ensure that loss of connectivity to an external key manager is detected before dependent workloads fail silently. Compromise of the external key manager is outside the scope of a service-side control. |