TMA-IBMCLOUD-8.1.1.3
Ensure all data stores are encrypted in the IBM Cloud®
Description
When you provision any data services in the IBM Cloud, such as Cloud Object Storage, Databases such as PostGreSQL, MongoDB, database for ElasticSearch, ETCD, backups created for any data store, and data volumes for compute etc., you want to encrypt the data-at-rest with your root key that you created in Key Protect key management service. You can use Bring Your Own Key (CRK) or provider key to enable encryption of your data-at-rest in data store associated with any of the services in the IBM Cloud that is integrated with the Key Protect Service. By encrypting your data with your own root key or service provided root key, you are protecting your data from unwanted access to your data. Even if the data is accessed, attacker cannot view the data as the encryption key is not stored with the data
How it is checked
Audit method: Manual review
This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.
Using Console: 1. Log in to the IBM Cloud® console. 2. Go to Menu, Resource List to view a list of your resources. 3. From your IBM Cloud resource list, click on Storage 4. From the list of Cloud Object Storage instances, click on one of the Instances 5. Cloud Object Storage dashboard shows a list of created buckets in that instance 6. Click on a bucket name to look at the details 7. Click on Key Management to see if the bucket is encrypted with an encryption key
How it is fixed
Fix method: Guidance or infrastructure patch
After you designate a root key in Key Protect and grant access between your services, you can enable envelope encryption for a specified storage bucket by using the IBM Cloud Object Storage GUI. Tip: To enable advanced configuration options for your storage bucket, ensure that an authorization exists between your IBM Cloud Object Storage and Key Protect instances. Using Console: To add envelope encryption to your storage bucket: 1. From your IBM Cloud® Object Storage dashboard, click Create bucket. 2. Specify the bucket's details. 3. In the Advanced Configuration section, select Add Key Protect Keys. 4. From the list of Key Protect service instances, select the instance that contains the root key that you want to use for key wrapping. 5. For Key Name, select the alias of the root key. 6. Click Create to confirm the bucket creation. From the IBM Cloud® Object Storage GUI, you can browse the buckets that are protected by a Key Protect root key.
Properties
- Operating systems
- Any
- Tags
- cloudencryptionibmcloud
- Reference
- CIS IBM Cloud Foundations Benchmark v2.0.0 - 8.1.1.3 Ensure all data stores are encrypted in the IBM Cloud®