CASE STUDY

SHE BASH Uses Virtru Private Keystore and Google CSE for CMMC Compliance

Watch Video

INDUSTRY

IT & Software, Federal Government
COMPLIANCE

CMMC/NIST/DFARS
PRODUCTS

Virtru Private Keystore, Virtru for Google Gmail, Virtru for Google Drive

See Virtru in Action

See how the defense contractor uses Google Drive Labels to categorize and govern CUI in Google Workspace.

SHE BASH is a trusted contractor in the defense industrial base, providing solutions that range from Zero Trust network architecture implementations to ICAM strategy and full-stack application development. Working for the Air Force and the DoD, SHE BASH needed to ensure CMMC compliance, which led them to Virtru Private Keystore for Google CSE.

In this video, SHE BASH CTO Cameron Banowsky and CEO Bunny Banowsky share their experience with Virtru for Google Workspace client-side encryption (CSE).

SHE BASH has architected an environment where CUI (controlled unclassified information) remains secure and well-governed both internally and externally. Notably, they're using Virtru Private Keystore to govern access to data using Google Drive Labels, which categorize data as CUI and enforce policy on that data based on the rules they've configured.

Want to learn more about how Virtru can support your CMMC compliance efforts, both in Google Workspace and Microsoft 365? Contact our team today to discuss our CMMC solutions.

Watch Video

Read transcript Hide transcript

We are SHE BASH. We provide technical services and solutions to the Department of Defense.

We are working with the Air Force and needed CMMC compliance, which led us to Virtru.

Working with the Virtru team for Private Keystore and CSE deployments was fantastic.

Given our Kubernetes competencies from government contracts, Virtru's direct Kubernetes deployment, available engineering resources, and ready deployment materials made setup extremely easy. The migration from Virtru hosted to self hosted keys was seamless and with highly responsive support.

We deployed, tested, and went to production within days.

Once running, we enabled drive labels to mark documents as CUI, or Controlled Unclassified Information, associate them with a group, and scope access to authorized users only. Seeing how Virtru implemented CSE through encrypted document access was fascinating, and it enabled us to fully leverage Google Workspace.

What I like about governance with Drive Labels in particular and Virtru is the authentication requirement for decryption.

If joe@shebash.io tries accessing a CUI document but isn't in that group, he gets access denied and a note to contact the admin.

I prefer a deny by default model of controls with explicit permissions over retroactively coming through potential access problems.

The big question at the beginning was, can the customer access the thing? Right? So if it's an encrypted email or whatever, I really wanted Cam or I needed Cam to to verify, yes, it's working. Yes, our customer POC was able to access the document, downloaded it fine, etc.

But when Cameron did confirm, 'Oh, yes, our primary POC, was able to click and access and do what he had to do with the thing,' that was music to my ears because from my perspective, that showed, like, okay. The entire loop is complete.

Let's let's continue moving forward with this.

We've established policies for CUI and have a good grasp on handling it. As we explore labels and access controls further, we can apply them broadly across other sensitive information, company data, personal data, etc.

We solved one problem and discovered the solution works for many others.