TMA-IBMCLOUD-3.6
Ensure Activity Tracker data is encrypted at rest
Описание
Ensure Activity Tracker data is encrypted at rest. IBM Cloud Logs uses encrypted storage for all its rest data. IBM Cloud Logs stores the Activity Tracker data in an IBM Cloud Object Storage (COS) bucket for long-term storage. By default, all objects that are stored in COS are encrypted by using randomly generated keys and an all-or-nothing-transform (AONT). Cloud Object Storage further supports additional key management scenarios to encrypt your data. This encryption model is called customer-managed encryption: 1. You can manage your keys manually by providing your own encryption keys - referred to as Server-Side Encryption with Customer-Provided Keys (SSE-C). 2. You can choose to use the integration capabilities with IBM Cloud® Key Management Services like IBM® Key Protect and Hyper Protect Crypto Services.
Как проверяется
Метод проверки: Ручная проверка
Эту рекомендацию нельзя проверить автоматически. Сканирование выводит её вместе с этими инструкциями при указании флага --include-manual.
1. Ensure IBM Cloud Activity Tracker Event Routing is configured to route audit events to one or more IBM Cloud Logs instances as documented. 2. For each IBM Cloud Logs instance, identify the IBM Cloud Object Storage buckets that are used for both the data bucket and the metrics bucket. In some cases, these will both use the same bucket, but for some clients separate COS buckets will be used. 3. Verify the data encryption configuration of the COS buckets being used by IBM Cloud Logs to store your data. Check the bucket configuration to verify that it meets your corporate and external market regulations. 4. Ensure that the CIS control 3.2 Ensure data retention for audit events is met, which outlines the encryptions settings in detail.
Как исправляется
Метод исправления: Рекомендация или патч инфраструктуры
If you have Cloud Object Storage buckets in use that do not meet your enterprise or industry encryption compliance requirements, use one of these options to implement the necessary encryption settings: A. Implement Server-Side Encryption with Customer-Provided Keys (SSE-C) B. Implement Server-Side Encryption with IBM Key Protect (SSE-KP) C. Implement Server-Side Encryption with Hyper Protect Crypto Services
Свойства
- Операционные системы
- Любая
- Теги
- cloudencryptionibmcloud
- Источник
- CIS IBM Cloud Foundations Benchmark v2.0.0 - 3.6 Ensure Activity Tracker data is encrypted at rest