TMA-IBMCLOUD-1.12
Ensure Context-Based Restrictions are implemented to enforce secure, conditional access to critical resources based on network location, IP range, or identity attributes
Descrição
IBM Cloud Context-Based Restrictions are a security feature that allows administrators to control access to cloud resources based on the context of the request, such as the IP address the request is made from, not just the identity of the user or service. IBM Cloud's Context-Based Restrictions (CBRs) provide an essential layer of defense by enforcing access conditions based on network location or type of endpoint, not just IAM roles. This means even if a user has the correct permissions, their request can be blocked if it originates from an untrusted context. By implementing CBRs, organizations can reduce the risk of unauthorized access, enforce compliance policies, and protect critical services like Cloud Object Storage, Key Protect, and Secrets Manager. In short, CBRs help turn identity-based access into context-aware security, which is vital in today’s hybrid and distributed enviro...
Como é verificado
Método de auditoria: Revisão manual
Esta recomendação não pode ser verificada automaticamente. Uma varredura a lista com estas instruções quando você passa --include-manual.
To check if you have a Context-Based Restriction (CBR) set in IBM Cloud, follow these steps: 1. Log in to the IBM Cloud Console: 2. Navigate to IAM, Context-based restrictions in the left-hand menu 3. Under the Rules tab, you'll see a list of all active CBR rules in your account. Each rule will show: o The network zone it applies to (e.g., IP ranges, VPCs) o The target service or resource (e.g., Cloud Object Storage, Key Protect) o The action (allow or deny) o Any conditions or exceptions 4. You can click on each rule to view its details, including which users or services it affects and when it was last modified. 5. If no rules are listed, then no CBRs are currently enforced in your account.
Como é corrigido
Método de correção: Orientação ou patch de infraestrutura
To create new trusted profile, complete the following steps: 1. Log in to the IBM Cloud Console: 2. Navigate to Manage, Context-based restrictions, then select Network zones from the left navigation menu. 3. click Create and define the network zone(s) you want to allow access from, using allowed or denied IP addresses, subnets, or ranges, VPCs, and IBM Cloud services. 4. Select Rules from the left navigation menu 5. Click Create and select the service, APIs, and resources you want the rule to apply to, select the context including the zone you defined, and specify whether to enable or report on this rule.
Propriedades
- Sistemas operacionais
- Qualquer
- Tags
- access-controlcloudibmcloudnetwork
- Referência
- CIS IBM Cloud Foundations Benchmark v2.0.0 - 1.12 Ensure Context-Based Restrictions are implemented to enforce secure, conditional access to critical resources based on network location, IP range, or identity attributes