Patterns for Encryption in Hybrid Cloud
summary
Practical pattern set for hybrid cloud encryption that names concrete components and tradeoffs: cloud key managers, an single-tenant HSM partition (FIPS 140-2), multi-cloud key manager to push BYOK, and an encryption manager with agents for files, folders and databases using PKCS#11 and KMIP. It lists five risks (storage loss, insider disclosure, resilience and recovery, connectivity, vendor lock) and notes only 20% of workloads are in cloud today. It shows key ceremony controls (smartcards, split key parts), backup/restore flows, and how to move encrypted data between clouds without decrypting.
AI-written summary · about
chapters (10)
- 0:00Start
- 6:54What are the risks we are trying to mitigate?
- 9:47Adopt architecture principles for different threats
- 13:17Components for Encryption and Key Management
- 18:23Traditional Multi-Cloud Key Management
- 19:31Remove On-Prem with Single-Tenant Cloud Key Manager
- 21:30Protect from Privileged Threat Actor Disclosure
- 22:34Enable Data Portability across Cloud Landing Zones
- 24:50Encryption and Key Management for Hybrid Cloud
- 25:43Embed Resilience into Encryption and Key Management
related talks
28mSecuring Multi-Cloud and Hybrid Environments
34mDesigning Secure Applications in the Cloud
27mDesigning Secure Applications in the Cloud
51mKey Management 101: DEKs, KEKs, and Credentials Living Together, Oh My!
10mSecuring Multi-Cloud APIs Against Quantum Threats
15mEncryption at Rest – Master Key Based on a Hybrid KEM
49mArchitecting Security for Regulated Workloads in Hybrid Cloud
13mEncrypting Your Way to Safety: Data Security in Kubernetes