TMA-IBMCLOUD-2.2.1.1

Ensure IBM Cloud® Block Storage for Virtual Private Cloud is encrypted with BYOK

Trung bìnhCấp 2Xem xét thủ côngibmcloud

Mô tả

By default, IBM Cloud® Block Storage for Virtual Private Cloud provides provider- managed encryption for all data. For enhanced security, customers can bring their own encryption keys and manage them through IBM Key Management Service – Key Protect. The customer can choose to use BYOK instead of provider-managed keys for enhanced security. When it comes to encryption of data at rest in IBM Cloud, the best practice is to allow customers to manage customer root keys(CRK) that are used to protect customer data stored in data and storage services in IBM Cloud. Bring your Own Key(BYOK) allows customers to ensure no one outside of their organization has access to the root key and with the support of BYOK, customers can manage the lifecycle of their customer root keys where they can create, rotate, delete those keys. This provides a significant level of control where those CRKs are managed b...

Cách kiểm tra

Phương pháp kiểm tra: Xem xét thủ công

Khuyến nghị này không thể kiểm tra tự động. Lần quét sẽ liệt kê mục này kèm hướng dẫn khi bạn truyền cờ --include-manual.

You can use the IBM® Cloud Block Storage for Virtual Private Cloud configuration properties to verify whether a block volume is enabled to use Key Protect. From Console, Navigate to your block volume resource: 1. In the IBM Cloud console, go to the Menu icon, VPC Infrastructure, Storage, Block storage volumes. A list of all block storage volumes displays. 2. For each of the volumes listed, ensure the encryption field specifies Key Protect.

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

You will not be able to add Key Protect as the key management service once data is already written to a Cloud Block Storage Volume. In order to ensure that the data is encrypted using Key Protect keys you will need to create a new Cloud Block Storage volume, set it to use Key Protect key management service and then upload/copy the existing data to this new volume.

Thuộc tính

Hệ điều hành: Bất kỳ
Thẻ: cloudencryptionibmcloud
Tham chiếu: CIS IBM Cloud Foundations Benchmark v2.0.0 - 2.2.1.1 Ensure IBM Cloud® Block Storage for Virtual Private Cloud is encrypted with BYOK