TMA-IBMCLOUD-2.2.2.3

Ensure IBM Cloud® File Storage for Virtual Private Cloud is encrypted with KYOK

MittelStufe 2Manuelle Prüfungibmcloud

Beschreibung

By default, IBM Cloud® File Storage for Virtual Private Cloud provides provider- managed encryption for all data. For enhanced security, customers can bring their own encryption keys and manage them through IBM Key Management Service – Hyper Protect Crypto Services (HPCS). The customer can choose to use KYOK instead of provider-managed keys for enhanced security. When it comes to encryption of data at rest in IBM Cloud, the best practice is to use encryption capabilities offered by Hardware Security Module crypto service. IBM Cloud Hyper protect Crypto Service (HPCS) offers Keep your Own Key (KYOK) capabilities that allow customers to have exclusive key control over encryption keys. This provides a significant level of control over encryption keys where only authorized users have access (no privileged users included IBM Cloud Admins) to encryption keys, in turn increases both security...

So wird geprüft

Prüfmethode: Manuelle Prüfung

Diese Empfehlung kann nicht automatisch geprüft werden. Ein Scan führt sie mit diesen Anweisungen auf, wenn Sie --include-manual übergeben.

You can use the IBM® Cloud File Storage for Virtual Private Cloud configuration properties to verify whether a file share is enabled to use Hyper Protect Crypto Service. From Console, Navigate to your file share resource: 1. In the IBM Cloud console, go to Menu icon, VPC Infrastructure, Storage, file storage shares. A list of all file shares is displays. 2. For each of the share listed, ensure the encryption field specifies Hyper Protect.

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

You will not be able to add Hyper Protect Crypto Services as the key management service once data is already written to a file share. In order to ensure that data is encrypted using Hyper Protect Crypto Services you will need to create a new file share, set it to use Hyper Protect Crypto Services key management service and then upload/copy the existing data to this new volume.

Eigenschaften

Betriebssysteme: Beliebig
Tags: cloudencryptionibmcloud
Referenz: CIS IBM Cloud Foundations Benchmark v2.0.0 - 2.2.2.3 Ensure IBM Cloud® File Storage for Virtual Private Cloud is encrypted with KYOK