Ensure Cloud Object Storage Encryption is set to On with BYOK

MédiaNível 2Revisão manualibmcloud

Descrição

You can use IBM Cloud encryption key management service, for example Key Protect, to bring your own root key (BYOK) to IBM Cloud and use it to add envelope encryption for data that is stored in IBM Cloud Object Storage buckets. When it comes to encryption of data at rest in IBM Cloud, the best practice is to allow customers to manage customer root keys (CRK) that are used to protect customer data stored in data and storage services in IBM Cloud. Bring your Own Key (BYOK) allows customers to ensure no one outside of their organization has access to the root key and and with the support of BYOK, customers can manage the lifecycle of their customer root keys where they can create, rotate, delete those keys. This provides a significant level of control where those CRKs are managed by the customer, which in turn increases both security control as well as meet relevant compliance requiremen...

Como é verificado

Método de auditoria: Revisão manual

Esta recomendação não pode ser verificada automaticamente. Uma varredura a lista com estas instruções quando você passa --include-manual.

You can use the IBM Cloud Object Storage bucket configuration properties to verify whether a Cloud Object Storage bucket is enabled to use Key Protect. Using Console: Navigate to your Cloud Object Storage instance: 1. Log in to IBM Cloud at https://cloud.ibm.com 2. Click the Menu icon and select Resource List 3. On the Resource List page under Storage, select the Cloud Object Storage instance that you have provisioned. 4. Click on the appropriate bucket that you would like to check 5. Click on Configuration and scroll down to Associated key management service to check/confirm if a Key Protect key management service is associated

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

You will not be able to add Key Protect as the key management service once data is already written to a Cloud Object Storage bucket. In order to ensure that objects are encrypted using Key Protect root keys you will need to create a new Cloud Object Storage bucket, set it to use Key Protect key management service and then upload/copy the existing objects to this new bucket.

Propriedades

Sistemas operacionais: Qualquer
Tags: cloudencryptionibmcloud
Referência: CIS IBM Cloud Foundations Benchmark v2.0.0 - 2.1.1.2 Ensure Cloud Object Storage Encryption is set to On with BYOK