[MUSIC PLAYING]
ALEX BUTNAREANU: Hey, you look stressed.
MARK MIRCHANDANI: Yeah.
I'm trying to migrate to the cloud,
but I also have to come up with this encryption strategy?
Like, I don't have time for this.
I've already got my hands full.
ALEX BUTNAREANU: OK, well, I have some good news.
With Google, moving to the cloud will actually
give you encryption by default.
MARK MIRCHANDANI: Encryption by default?
Can you show me how that works?
ALEX BUTNAREANU: Sure thing.
Let's take a look.
MARK MIRCHANDANI: OK.
[MUSIC PLAYING]
ALEX BUTNAREANU: Encryption at rest
is central to our security strategy,
and there are several options based on the customer's
security needs.
By default, data at rest is encrypted in all Google Cloud
Platform products.
For certain classes of data or where you have a requirement
to manage your encryption key, we
give customers the option of managing their own keys
using Customer-Managed Encryption Keys, or CMEC
for short, using a managed service called Cloud KMS.
Then, for a small percentage of workloads,
there may be a requirement to generate your own encryption
key or manage it on premise.
And for that we provide the option
to use Customer-Supplied Encryption Keys, or CSEC
for short.
Let's see how this works.
By default, when I upload a file to cloud storage,
it will automatically be encrypted at rest
with Google-managed keys, as we can see here.
This is transparent to the user, but a lot
happens behind the scenes.
Data's split into chunks, and each chunk
is encrypted with a unique data encryption key.
Then these data encryption keys are
encrypted with their own key encryption keys,
stored in Google's KMS.
The data chunks are then distributed across Google Cloud
Storage systems and replicated in encrypted form for backup
and disaster recovery.
And this happens in real time, all by default
and transparent to the user.
MARK MIRCHANDANI: Well, that's a relief.
But, like, I still have to manage our key rotation
policies.
And I've got keys that I have to do hardware-backed encryption
for.
What am I supposed to do about that?
ALEX BUTNAREANU: No worries.
We can handle that too.
Let me show you how.
MARK MIRCHANDANI: Sure.
ALEX BUTNAREANU: Cloud KMS is a hosted Key Management Service
that lets you manage crypto keys for you
cloud services similar to the way you'd do it on premise.
It's also integrated into cloud IM and cloud auto-logging,
so you can manage permissions and individual keys
and monitor how they are used.
We'll start by creating a new keyring.
First, we name it.
Then, we can choose a location like make global.
However, the rank location matters based
on where my resources are.
I'm going to pick US central, as that's where my workloads are.
Now I create my key.
First, I can specify the name.
Then, each key has a purpose which
defines the cryptographic capabilities of the key.
I'm going to choose to use this to do symmetric encrypt
or decrypt.
I can then choose if this is software- or hardware-backed.
If there is a requirement to use hardware, we can use HSM.
Cloud HSM is a Cloud Hosted Hardware security module
service that allows you to host encryption keys
and perform cryptographic operations
in a cluster of Phipps 140-2 level 3 certified HSMs,
all managed by Google for you.
Next, I can specify the rotation period,
which is the time between when the new key versions are
generated automatically.
And let's say I want to go ahead and use
hardware encryption via HSM, and make the rotation period 30
days, and click "create."
Let's go back to our storage bucket example
I can create a new bucket and configure
it to use my new customer-managed encryption
key policies.
I give it a name.
Region is still US central with my keys and HSMs,
and now I can change the encryption options
from Google-managed key to customee-managed key.
Soon as I do that, my keyring and keys pop up,
and I can choose which one to use.
Lastly, I need to authorize a service account
to perform, encrypt, and decrypt operations
with the key I just selected.
Granted.
Now when I upload a file, whether it's
a few kilobytes or a few petabytes,
it will be encrypted using my key.
So let's upload a file called "Super Important File."
And you can see it's indeed using customer-managed keys,
and it's the actual key I selected.
When I click on it, I can open it.
Now let's go back to my keys.
The whole point of CMEC using KMS
is to give customers control over key policies.
So let's say I want to go and now disable that key.
Once I disable it, although not immediately,
I will no longer be able to access the file.
Let's try it.
Software key's been disabled.
I try to open the file.
I can see that I can no longer access it, and the error I get
is that cloud KMS has been disabled or destroyed.
And in the KMS UI, I can see that the key I was using
was indeed disabled.
That's what we mean by customer-managed keys.
MARK MIRCHANDANI: Wow, so now I have the option
to choose what encryption strategy makes sense for me,
and I can mix and match for different parts of my cloud
migration.
ALEX BUTNAREANU: That's right.
Encryption is a complex topic, so we
work really hard to make sure the full complexity is
abstracted away.
That way, you get the best innovations
and control where you need it.
MARK MIRCHANDANI: Don't forget to like, comment,
and subscribe for more great Google Cloud Platform content.
[MUSIC PLAYING]