Ensure Cloud Object Storage Encryption is set to On with KYOK

SedangLevel 2Tinjauan manualibmcloud

Deskripsi

You can use IBM Cloud encryption key management services, for example, Hyper Protect Crypto Services to keep and manage exclusive control over the root keys used to add envelop encryption for data that is stored in IBM Cloud Object Storage buckets. When it comes to encryption of data at rest in IBM Cloud, the best practice is to allow customers use encryption capabilities offered by Hardware Security Module crypto service. IBM Cloud Hyper Protect Crypto Services offers Keep your Own Key (KYOK) capabilities that allow customers to have exclusive key control over encryption keys. This provides a significant level of control over encryption keys where only authorized users have access (no privileged users included IBM Cloud Admins) to encryption keys, in turn increases both security control as well as meet relevant compliance requirements.

Cara pemeriksaan

Metode audit: Tinjauan manual

Rekomendasi ini tidak dapat diperiksa secara otomatis. Pemindaian akan menampilkannya beserta petunjuk ini saat Anda memberikan opsi --include-manual.

You can use the IBM Cloud Object Storage bucket configuration properties to verify whether a Cloud Object Storage bucket is configured to use Hyper Protect Crypto Services key management service. Using Console: Navigate to your Cloud Object Storage instance: 1. Log in to IBM Cloud at https://cloud.ibm.com 2. Click the Menu icon and select Resource List 3. On the Resource List page under Storage, select the Cloud Object Storage instance that you have provisioned. 4. Click on the appropriate bucket that you would like to check 5. Click on Configuration and scroll down to Associated key management service to check/confirm if Hyper Protect Crypto Services key is configured with the bucket

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

You will not be able to add Hyper Protect Crypto Services as the key management service once data is already written to a Cloud Object Storage bucket. In order to ensure that objects are encrypted using Hyper Protect Crypto Services root keys you will need to create a new Cloud Object Storage bucket, set it to use Hyper Protect Crypto Services key management service and then upload/copy the existing objects to this new bucket.

Properti

Sistem operasi: Apa saja
Tag: cloudencryptionibmcloud
Referensi: CIS IBM Cloud Foundations Benchmark v2.0.0 - 2.1.1.3 Ensure Cloud Object Storage Encryption is set to On with KYOK