IBM Cloud
TMA-IBMCLOUD-2.2.3
Ensure boot volumes are encrypted with Customer managed keys
Descrição
By default, IBM Cloud® Block Storage for Virtual Private Cloud provides provider- managed encryption for all data. For enhanced security, customers can bring their own encryption keys and manage them through IBM Key Management Services – Key Protect or Hyper Protect Crypto Services (HPCS). With customer-managed keys, only customers can access and manage their master root keys, giving them full control over their data security.
Como é verificado
Método de auditoria: Revisão manual
You can use the IBM® Cloud Block Storage for Virtual Private Cloud configuration properties to verify whether a block volume is enabled to use Key Protect or Hyper Protect key management services. From Console, Navigate to your block volume resource: 1. In the IBM Cloud console, go to Menu icon, VPC Infrastructure, Storage, Block storage volumes. A list of all block storage volumes displays. 2. For each volumes listed with Attachment Type column value Boot, ensure the encryption field is Not pointing to Provider Managed.
Como é corrigido
Método de correção: Orientação ou patch de infraestrutura
You will not be able to change encryption option once data is already written to a Cloud Block Storage Volume. In order to ensure that data is encrypted using customer managed keys you will need to create a new Cloud Block Storage volume, set it to use either Key Protect or Hyper Protect key management service and then upload/copy the existing objects to this new volume.
Propriedades
- Sistemas operacionais
- Qualquer
- Tags
- cloudcryptoencryptionibmcloud
- Referência
- CIS IBM Cloud Foundations Benchmark v2.0.0 - 2.2.3 Ensure boot volumes are encrypted with Customer managed keys