TMA-IBMCLOUD-3.6
Ensure Activity Tracker data is encrypted at rest
Mô tả
Ensure Activity Tracker data is encrypted at rest. IBM Cloud Logs uses encrypted storage for all its rest data. IBM Cloud Logs stores the Activity Tracker data in an IBM Cloud Object Storage (COS) bucket for long-term storage. By default, all objects that are stored in COS are encrypted by using randomly generated keys and an all-or-nothing-transform (AONT). Cloud Object Storage further supports additional key management scenarios to encrypt your data. This encryption model is called customer-managed encryption: 1. You can manage your keys manually by providing your own encryption keys - referred to as Server-Side Encryption with Customer-Provided Keys (SSE-C). 2. You can choose to use the integration capabilities with IBM Cloud® Key Management Services like IBM® Key Protect and Hyper Protect Crypto Services.
Cách kiểm tra
Phương pháp kiểm tra: Xem xét thủ công
Khuyến nghị này không thể kiểm tra tự động. Lần quét sẽ liệt kê mục này kèm hướng dẫn khi bạn truyền cờ --include-manual.
1. Ensure IBM Cloud Activity Tracker Event Routing is configured to route audit events to one or more IBM Cloud Logs instances as documented. 2. For each IBM Cloud Logs instance, identify the IBM Cloud Object Storage buckets that are used for both the data bucket and the metrics bucket. In some cases, these will both use the same bucket, but for some clients separate COS buckets will be used. 3. Verify the data encryption configuration of the COS buckets being used by IBM Cloud Logs to store your data. Check the bucket configuration to verify that it meets your corporate and external market regulations. 4. Ensure that the CIS control 3.2 Ensure data retention for audit events is met, which outlines the encryptions settings in detail.
Cách khắc phục
Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng
If you have Cloud Object Storage buckets in use that do not meet your enterprise or industry encryption compliance requirements, use one of these options to implement the necessary encryption settings: A. Implement Server-Side Encryption with Customer-Provided Keys (SSE-C) B. Implement Server-Side Encryption with IBM Key Protect (SSE-KP) C. Implement Server-Side Encryption with Hyper Protect Crypto Services
Thuộc tính
- Hệ điều hành
- Bất kỳ
- Thẻ
- cloudencryptionibmcloud
- Tham chiếu
- CIS IBM Cloud Foundations Benchmark v2.0.0 - 3.6 Ensure Activity Tracker data is encrypted at rest