TMA-IBMCLOUD-2.2.5
Ensure unattached volumes are encrypted with customer managed keys
설명
By default, IBM Cloud® Block Storage provides provider-managed encryption for all data. For enhanced security, customers can bring their own encryption keys and manage them through IBM Key Management Services – Key Protect or Hyper Protect Crypto Services (HPCS). With customer-managed keys, only customers can access and manage their master root keys, giving them full control over their data security.
점검 방법
감사 방식: 수동 검토
이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.
You can use the IBM® Cloud Block Storage for Virtual Private Cloud configuration properties to verify whether a block volume is enabled to use Key Protect or Hyper Protect key management services. From Console, Navigate to your Cloud Object Storage instance: 1. In the IBM Cloud console, go to Menu icon, VPC Infrastructure, Storage, Block storage volumes. A list of all block storage volumes will be displayed. 2. For each volumes listed without any value in the "Attachment Type" column, ensure the encryption field is Not pointing to "Provider Managed".
조치 방법
조치 방식: 가이드 또는 인프라 패치
You will not be able to change encryption option once data is already written to a Cloud Block Storage Volume. In order to ensure that data is encrypted using customer managed keys you will need to create a new Cloud Block Storage volume, set it to use either Key Protect or Hyper Protect key management service and then upload/copy the existing data to this new volume.
속성
- 운영 체제
- 모두
- 태그
- cloudcryptoencryptionibmcloud
- 참고 자료
- CIS IBM Cloud Foundations Benchmark v2.0.0 - 2.2.5 Ensure unattached volumes are encrypted with customer managed keys