Professional Cloud ArchitectAnalyze and optimize technical and business processesMedium
A multinational company is migrating its enterprise resource planning (ERP) system to Google Cloud. The ERP system uses a relational database that stores highly sensitive customer data. The company requires strict control over encryption keys and wants to ensure that Google does not have access to these keys. What encryption option should be implemented for the database?
- ACustomer-supplied encryption keys (CSEK).
- BCustomer-managed encryption keys (CMEK).
- CApplication-layer encryption within the ERP system.
- DGoogle-managed encryption keys (GMEK).
Show answer & explanationAnswer & explanation
Correct answer: A. Customer-supplied encryption keys (CSEK).
Customer-Supplied Encryption Keys (CSEK) allows customers to provide their own encryption keys to Google Cloud. With CSEK, Google does not store the encryption keys, ensuring the highest level of customer control and preventing Google from accessing the data without the customer's key.
Why the other options are wrong
- B. CMEK allows customers to manage keys in Cloud Key Management Service (KMS), but Google still has access to KMS and can use the keys to encrypt/decrypt data on your behalf.
- C. Application-layer encryption is a good practice but is typically in addition to, not a replacement for, database-level encryption, and doesn't address the specific requirement of Google not having access to the encryption keys at the database layer.
- D. GMEK means Google manages the keys, which doesn't meet the requirement of Google not having access.
Google Cloud Encryption Options
Google Cloud offers various encryption key management options, providing different levels of customer control over encryption keys for data at rest and in transit.
- GMEK: Google manages keys, default for most services.
- CMEK: Customer manages keys in Cloud KMS, Google uses them.
- CSEK: Customer supplies keys directly for each operation, Google does not store them.
- Application-layer encryption: Handled by the application itself.
Memory trick: Control of your keys dictates Google's access level.