Ensure all data stores are encrypted in the IBM Cloud®

높음레벨 1수동 검토ibmcloud

설명

When you provision any data services in the IBM Cloud, such as Cloud Object Storage, Databases such as PostGreSQL, MongoDB, database for ElasticSearch, ETCD, backups created for any data store, and data volumes for compute etc., you want to encrypt the data-at-rest with your root key that you created in Key Protect key management service. You can use Bring Your Own Key (CRK) or provider key to enable encryption of your data-at-rest in data store associated with any of the services in the IBM Cloud that is integrated with the Key Protect Service. By encrypting your data with your own root key or service provided root key, you are protecting your data from unwanted access to your data. Even if the data is accessed, attacker cannot view the data as the encryption key is not stored with the data

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Using Console: 1. Log in to the IBM Cloud® console. 2. Go to Menu, Resource List to view a list of your resources. 3. From your IBM Cloud resource list, click on Storage 4. From the list of Cloud Object Storage instances, click on one of the Instances 5. Cloud Object Storage dashboard shows a list of created buckets in that instance 6. Click on a bucket name to look at the details 7. Click on Key Management to see if the bucket is encrypted with an encryption key

조치 방법

조치 방식: 가이드 또는 인프라 패치

After you designate a root key in Key Protect and grant access between your services, you can enable envelope encryption for a specified storage bucket by using the IBM Cloud Object Storage GUI. Tip: To enable advanced configuration options for your storage bucket, ensure that an authorization exists between your IBM Cloud Object Storage and Key Protect instances. Using Console: To add envelope encryption to your storage bucket: 1. From your IBM Cloud® Object Storage dashboard, click Create bucket. 2. Specify the bucket's details. 3. In the Advanced Configuration section, select Add Key Protect Keys. 4. From the list of Key Protect service instances, select the instance that contains the root key that you want to use for key wrapping. 5. For Key Name, select the alias of the root key. 6. Click Create to confirm the bucket creation. From the IBM Cloud® Object Storage GUI, you can browse the buckets that are protected by a Key Protect root key.

속성

운영 체제: 모두
태그: cloudencryptionibmcloud
참고 자료: CIS IBM Cloud Foundations Benchmark v2.0.0 - 8.1.1.3 Ensure all data stores are encrypted in the IBM Cloud®