Whether driven by government policy, industry regulation, or geo-political considerations, the evolution of cloud computing has led organizations to want even more control over their data and more transparency from their cloud services. At Google Cloud, one of the best tools for achieving that level of control and transparency is a bit of technological magic we call Cloud External Key Manager (EKM).

Cloud EKM can help you protect your cloud data at rest with encryption keys which are stored and managed in a third-party key management system that’s outside Google Cloud’s infrastructure, and ultimately outside Google’s control. This can help you achieve full separation between your encryption keys and your data stored in the cloud. Cloud EKM works with symmetric and asymmetric encryption keys, and offers organization policies that allow for fine-grained control over what types of keys are used. Via Key Access Justification (KAJ) it also offers a way for clients to control each key use.

At their core, many cloud security and cloud computing discussions are about the kinds of trust that Cloud EKM specifically and encryption more broadly can help create. While the concept of digital trust is much bigger than cybersecurity and its tripartite components of security, privacy, and compliance, one of the most crucial themes of cloud computing is the cloud trust paradox. In order to trust the cloud more, you must be able to trust it less, and external control of keys and their use can help reduce concerns over unauthorized access to sensitive data.

How it works

From our Cloud EKM documentation, you can use keys that you manage within a supported external key management partner to protect data within Google Cloud. You can protect data at rest in services that support CMEK, or by calling the Cloud Key Management Service API directly.

Cloud EKM provides several benefits:

• Key provenance: You control the location and distribution of your externally-managed keys. Externally-managed keys are never cached or stored within Google Cloud. Google cannot see them. Instead, Cloud EKM communicates directly with the external key management device for each request.
• Access control: You manage access to your externally-managed keys. Before you can use an externally-managed key to encrypt or decrypt data in Google Cloud, you must grant the Google Cloud project access to use the key. You can revoke this access at any time.
• Centralized key management: You can manage your keys and access policies from a single location and user interface, whether the data they protect resides in the cloud or on your premises. The system that managed the keys is entirely outside Google control.

In all cases, the key resides on the external system, and is never sent to Google.

Here’s how it works:

1. Create or use an existing key in a supported external key management partner system. This key has a unique URI.
2. Grant your Google Cloud project access to use the key, in the external key management partner system.
3. Create a Cloud EKM key in your Google Cloud project, using the URI for the externally-managed key.

The Cloud EKM key and the external key management partner key work together to protect your data. The external key is never exposed to Google and cannot be accessed by Google employees. Furthermore, Cloud EKM can be combined with Key Access Justifications (KAJ) to establish cryptographic control over data access.

KAJ with Cloud EKM can give customers the ability to deny Google Cloud administrators access to their data at rest for any reason, even in situations typically exempted from customer control, such as outages or responses to third-party data requests. KAJ does this by providing customers a clear reason why data is being decrypted, which they can use to programmatically decide whether to permit decryption and thus allow access to their data.

Previously, we’ve discussed three patterns where keeping the keys off the cloud may in fact be truly necessary or outweighs the benefits of cloud-based key management. Here’s a brief summary of those three scenarios where Cloud EKM can help solve these Hold Your Own Key dilemmas.

Scenario 1: The last data to go to the cloud

As organizations complete their digital transformations by migrating data processing workloads to the cloud, there is often a pool of data that can not be moved to the cloud. Perhaps it’s the most sensitive data, the most regulated data, or the data with the toughest internal security control requirements.

Finance, healthcare, manufacturing and other heavily-regulated organizations face myriad risk, compliance, and policy reasons that may make it challenging to send some of their data to a public cloud provider. However, the organization may be willing to migrate this data set to the cloud as long as it is encrypted and they have sole possession of the encryption keys.

Scenario 2: Regional regulations and concerns

Regional requirements are playing a larger role in how organizations migrate to and operate workloads in the public cloud.

Some organizations are already facing situations where they are based in one country and want to use a cloud provider based in a different country, but they aren’t comfortable with or legally allowed to give the provider access to encryption keys for their stored data. Here the situations are more varied, and can include an organization’s desire to stay ahead of evolving regulatory demands or industry-specific mandates.

Ultimately, this scenario allows organizations to utilize Google Cloud while keeping their encryption keys in the location of their choice, and under their physical and administrative control.

Scenario 3: Centralized encryption key control

The focus here is on operational efficiency. Keeping all the keys within one system to cover multiple cloud and on-premise environments can help reduce overhead and attack surface, thus helping to improve security. As Gartner researchers concluded in their report, “Develop an Enterprisewide Encryption Key Management Strategy or Lose the Data1,” organizations are motivated to reduce the number of key management tools.

“By minimizing the number of third-party encryption solutions being deployed within an environment, organizations can focus on establishing a cryptographic center of excellence,” Gartner researchers said

Given that few organizations are 100% cloud-based today for workloads that require encryption, keeping keys on-prem can streamline key management. Centralizing key management can give the cloud user a central location to enforce policies around access to keys and access to data-at-rest, while a single set of keys can help reduce management complexity. A properly implemented system with adequate security and redundancy outweighs the need to have multiple systems.

Do I need Cloud EKM?

Whether protecting highly sensitive data, retaining key control to address geopolitical and regional concerns, or supporting hybrid and multi-cloud architectures, Cloud EKM is best suited for those Google Cloud customers who must keep their encryption keys off of the cloud and always under their full control.

To learn more about Cloud EKM, please review these resources:

• Our research explaining why Google Cloud users can benefit from Cloud EKM
• The most recent updates to Cloud EKM
• Take a deeper dive into the cloud trust paradox

1. Gartner, Develop an Enterprisewide Encryption Key Management Strategy or Lose the Data, David Mahdi, Brian Lowans, March 2022.

Snap inc., the developer of the Snapchat platform, has become a global leader in the social media industry. Snap runs its business on Google Cloud, and relies on Premium Support to optimize its cloud business imperatives. Snap sought new ways to extract business value from their cloud data, so turned to their assigned Google Technical Account Management team to develop a means to strengthen and expand cloud skills to meet their goal.  The Technical Account Managers (TAMs) serve as an extension of the Snap Engineering Program Management team to deliver deep expertise of Google Cloud and guide Snap in their cloud journey including mapping the essential cloud skills for Snap to achieve broader business strategy.  Since Snap employees had varying levels of cloud expertise, it meant that their TAM team needed to design a tailored learning program to optimally meet Snap’s needs.

The TAM team engaged with Google Cloud Customer Experience (CCE) team which included cloud support, learning, consulting, customer success and customer insight and advocacy services. The Google team leveraged a Skill Training Survey for the Snap team to identify, extract and map existing skills to the level of targeted cloud skills that would enable them to design a learning curriculum to boost employee productivity, enable efficient scaling and strengthen the mitigation of technical issues while optimizing their environment for issue prevention. In addition, Google Cloud offered instructor-led virtual training focused on Looker, Kubernetes and others topics of interest and a tailored Snap Global Training Program was launched in the last quarter of 2022.

By including training for Looker, it expanded Snap employees’ ability to reach data-driven decisions. Snap also took advantage of the Google Cloud Skills Boost licenses delivering access to a learning platform with over 700 courses and learning labs,  included with Premium Support. 

Next, the TAMs and CCE teams were tasked to raise internal awareness of the global Snap training program, so they developed a comprehensive marketing and communications plan to drive promotion over a twelve week period to prospective trainees through newsletters, email groups, Slack channels, Engineering meetings, and an internal site dedicated to Snap training resources. 

“Partnering with Google to provide Snap engineers with learning opportunities aligns with Snap’s values of Kind, Smart and Creative.  Investing in growing our team member’s skills helps them personally advance and helps our business achieve our goals.”—Michele Vaughan, Snap Engineering Program Manager

The Google-led Snap Global Training Program includes hands-on, instructor-led training, in-person gamified Cloud Hero Learning Events, and access to on-demand Google Cloud Skills Boost labs. Over 100 trainees at Snap initially participated in the instructor-led training, and more than 500 employees completed the on-demand labs. This training program has enabled Snap employees to develop and strengthen skills in the targeted cloud areas including data visualization, AI and ML, and Kubernetes. In addition, the program ignited a Looker Advisory Professional Services initiative to advise Snap with best practices and improvements for the usage of Looker. These skills enable Snap to extract increased value for their cloud data and guide the future of their business for sustaining a competitive advantage in a dynamic marketplace. 

To learn more about how Google Cloud Customer Experience can support your organization’s business transformation journey with cloud support, learning, consulting, customer success, and customer insight and advocacy services, visit:

•  Premium Support to empower business innovation with expert-led technical guidance and cloud support
•  Google Cloud Training & Certification to expand and diversify your team’s cloud education

We launched the Chrome Insider blog in 2019 to share tips and best practices with IT admins so they could better deploy, manage, and secure Chrome browser. Since then, the series has covered everything from supporting legacy browsers to protecting enterprise credentials to simplifying deployments. To make it even easier to find and browse the series, we’ve pulled together all the posts to date here so you can read them all in one place or bookmark them for later.

Managing Chrome tips and tricks

• Understanding Policy Precedence for Chrome browser
• Protecting enterprise credentials with Password Alert
• Managing Chrome browser in a controlled environment
• Simplifying Chrome deployments on macOS
• Configuring Chrome browser in your VDI environment
• Know your options for Modern Enterprise Browser Management
• Managing policies and extensions across operating systems in Chrome Browser

Improving extension management and reporting 

• Improving Chrome browser extension management through permissions
• Publishing custom extensions for the enterprise
• Enhanced extension reporting with Chrome Browser’s Takeout API

Ensuring your organization is secure 

• Managing BeyondCorp Enterprise’s threat and data protection capabilities in Chrome
• A primer on enterprise private browsing modes

Increasing your organization’s productivity

• Ready, set, Chrome—Improvements and polices to make Chrome more performant
• Troubleshooting with Chrome Browser
• Preparing your enterprise for Flash deprecation
• Apps from the past? Fear not with legacy browser support in Chrome Enterprise

Although the series is 16 posts strong, there are plenty more Chrome Insider posts to come. You can read these posts and more on our Chrome Enterprise channel.