Ensure IBM Cloud® Block Storage for Virtual Private Cloud is encrypted with KYOK

中级别 2人工审核ibmcloud

说明

By default, IBM Cloud® Block Storage for Virtual Private Cloud provides provider- managed encryption for all data. For enhanced security, customers can bring their own encryption keys and manage them through IBM Key Management Service – Hyper Protect Crypto Services (HPCS). The customer can choose to use KYOK instead of provider-managed keys for enhanced security. When it comes to encryption of data at rest in IBM Cloud, the best practice is to allow customers use encryption capabilities offered by Hardware Security Module crypto service. IBM Cloud Hyper protect Crypto Service (HPCS) offers Keep your Own Key (KYOK) capabilities that allow customers to have exclusive key control over encryption keys. This provides a significant level of control over encryption keys where only authorized users have access (no privileged users included IBM Cloud Admins) to encryption keys, in turn increa...

检查方式

审计方法: 人工审核

此项建议无法自动检查。当您传入 --include-manual 时，扫描结果会列出该项并附带这些说明。

You can use the IBM® Cloud Block Storage for Virtual Private Cloud configuration properties to verify whether a block volume is enabled to use Hyper Protect Crypto Service. From Console, Navigate to your block volume resource: 1. In the IBM Cloud console, go to the Menu icon, VPC Infrastructure, Storage, Block storage volumes. A list of all block storage volumes displays. 2. For each of the volumes listed, ensure the encryption field specifies Hyper Protect.

修复方式

修复方法: 操作指南或基础设施补丁

You will not be able to add Hyper Protect Crypto Services as the key management service once data is already written to a Cloud Block Storage Volumes. In order to ensure that data is encrypted using Hyper Protect Crypto Services you will need to create a new Cloud Block Storage volume, set it to use Hyper Protect Crypto Services key management service and then upload/copy the existing data to this new volume.

属性

操作系统: 任意
标签: cloudencryptionibmcloud
参考: CIS IBM Cloud Foundations Benchmark v2.0.0 - 2.2.1.2 Ensure IBM Cloud® Block Storage for Virtual Private Cloud is encrypted with KYOK