I would like to provision services from a Software as a Service (SaaS) provider. This is multitenant environment (multiple companies will be using a single instance of the application, with a single database, running on the same hardware and same OS).
Our company has a requirement to encrypt our data at rest (e.g. file stores, databases, backups).
Most of the guidance I have read states that the key should be kept with the customer or a third party and not with the cloud provider.
If I have the key; then every user in my company will need the key to access the file store once logged in? How would this work practically? Will the key be binded with my a users Username and Password?
Other option is to store the key in a configuration file on the cloud platform and managed by the cloud provider. But this creates another problem of securing the config file and the risk of having our key on a shared platform.
Where can the cloud provider store the key securely so that only I and my employees can use it?
What is best practice in terms of key management when having encrypted data on the cloud?
Best practice from my research states the following:
• Store the key with the customer or 3rd party
• Only authorised persons to access the key.
• Do not store the key on the same platform as the data.