How key management works
Keys should be generated with strong randomness and sufficient length, then stored in protected systems such as hardware security modules or cloud key management services rather than in code or configuration files. Access to keys is limited and logged.
Policies define key lifetimes and rotation, backup and recovery, and what happens when a key is suspected compromised. Separation of duties, envelope encryption and key hierarchies reduce exposure, and unused keys are retired and securely destroyed. Envelope encryption protects data with a data key, which is itself encrypted by a master key, allowing master keys to stay protected while data keys are used at scale.
Why it matters for Canadian organizations
If keys are lost, encrypted data may be unrecoverable; if keys are stolen, encryption provides little protection. Poor handling, such as hardcoded keys in repositories, is a common cause of exposure.
Encryption is a recognized safeguard for personal information under PIPEDA and Quebec Law 25, and sound key management is what gives it value. Where data is hosted in the cloud, organizations should understand who controls the keys and where they reside. Regulatory and contractual terms sometimes specify where keys may be held or who may access them, so involve legal and privacy teams in decisions about key custody.
How to implement it
Use managed key services or hardware security modules, and keep keys separate from the data they protect. Apply least privilege and multi-person controls to key administration.
Automate rotation, monitor key usage, and keep secrets out of source code using a secrets manager. Document recovery procedures and test them, since a backup that cannot restore keys is as damaging as no backup. Audit logs of key creation, use and deletion help detect misuse and provide evidence to assessors that cryptographic controls are working as intended.
Frequently asked questions
What is a hardware security module?
A hardware security module is a tamper-resistant device that generates, stores and uses cryptographic keys without exposing them in plain form. Cloud providers offer managed equivalents. They are used when stronger assurance for key protection is required.
How often should encryption keys be rotated?
It depends on the key's purpose, sensitivity and applicable standards. Rotation schedules commonly range from months to a few years, with immediate rotation after suspected compromise. Automation makes frequent rotation practical and reduces human error.
Should I manage my own keys in the cloud?
Provider-managed keys are simpler and adequate for many needs. Customer-managed or customer-supplied keys give more control and may help meet certain requirements, but add operational responsibility. The right choice depends on data sensitivity and regulatory expectations.
Related service: Cloud security