Ensure that hardware crypto cards/modules (HSM) are used to store SSL/TLS certificates

높음레벨 2수동 검토websphere

설명

Hardware security modules (HSMs) are hardened, tamper-resistant hardware devices that secure cryptographic processes by generating, protecting, and managing keys used for encrypting and decrypting data and creating digital signatures and certificates. The benchmark marks this recommendation Manual; TMAegis reports it as a manual review item with the audit steps.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Ensure that the location attribute is set to the specific hardware crypto configuration file. In addition ensure that type attribute is set to PKCS11. Both these are under the keyStore element of the SSL configuration in the Liberty configuration. grep -w -R -i 'location' ${server.config.dir} grep -w -R -i 'type' ${server.config.dir}

조치 방법

조치 방식: 가이드 또는 인프라 패치

Configure the location attribute to the specific hardware crypto card configuration file. In addition configure the type attribute to PKCS11. Both these attributes are in the keyStore element used by the SSL configuration in ${server.config.dir}/configDropins/overrides/*.xml. In this example, the HWCryto.cfg contains the hardware crypto configuration information. <keyStore id="hwKeyStore" location="${server.config.dir}/HWCrypto.cfg" type="PKCS11" fileBased="false" provider="IBMPKCS11Impl" ... />

속성

운영 체제: 모두
태그: webspheremanual-review
참고 자료: CIS IBM WebSphere Liberty Benchmark v1.0.0 - 4.2.13 Ensure that hardware crypto cards/modules (HSM) are used to store SSL/TLS certificates