Ensure boot volumes are encrypted with Customer managed keys

中级别 2人工审核ibmcloud

说明

By default, IBM Cloud® Block Storage for Virtual Private Cloud provides provider- managed encryption for all data. For enhanced security, customers can bring their own encryption keys and manage them through IBM Key Management Services – Key Protect or Hyper Protect Crypto Services (HPCS). With customer-managed keys, only customers can access and manage their master root keys, giving them full control over their data security.

检查方式

审计方法: 人工审核

此项建议无法自动检查。当您传入 --include-manual 时，扫描结果会列出该项并附带这些说明。

You can use the IBM® Cloud Block Storage for Virtual Private Cloud configuration properties to verify whether a block volume is enabled to use Key Protect or Hyper Protect key management services. From Console, Navigate to your block volume resource: 1. In the IBM Cloud console, go to Menu icon, VPC Infrastructure, Storage, Block storage volumes. A list of all block storage volumes displays. 2. For each volumes listed with Attachment Type column value Boot, ensure the encryption field is Not pointing to Provider Managed.

修复方式

修复方法: 操作指南或基础设施补丁

You will not be able to change encryption option once data is already written to a Cloud Block Storage Volume. In order to ensure that data is encrypted using customer managed keys you will need to create a new Cloud Block Storage volume, set it to use either Key Protect or Hyper Protect key management service and then upload/copy the existing objects to this new volume.

属性

操作系统: 任意
标签: cloudcryptoencryptionibmcloud
参考: CIS IBM Cloud Foundations Benchmark v2.0.0 - 2.2.3 Ensure boot volumes are encrypted with Customer managed keys