Ensure Cloud Object Storage Encryption is set to On with BYOK

中等級 2人工審核ibmcloud

說明

You can use IBM Cloud encryption key management service, for example Key Protect, to bring your own root key (BYOK) to IBM Cloud and use it to add envelope encryption for data that is stored in IBM Cloud Object Storage buckets. When it comes to encryption of data at rest in IBM Cloud, the best practice is to allow customers to manage customer root keys (CRK) that are used to protect customer data stored in data and storage services in IBM Cloud. Bring your Own Key (BYOK) allows customers to ensure no one outside of their organization has access to the root key and and with the support of BYOK, customers can manage the lifecycle of their customer root keys where they can create, rotate, delete those keys. This provides a significant level of control where those CRKs are managed by the customer, which in turn increases both security control as well as meet relevant compliance requiremen...

檢查方式

稽核方法: 人工審核

此項建議無法自動檢查。當您傳入 --include-manual 時，掃描結果會列出此項目並附帶這些說明。

You can use the IBM Cloud Object Storage bucket configuration properties to verify whether a Cloud Object Storage bucket is enabled to use Key Protect. Using Console: Navigate to your Cloud Object Storage instance: 1. Log in to IBM Cloud at https://cloud.ibm.com 2. Click the Menu icon and select Resource List 3. On the Resource List page under Storage, select the Cloud Object Storage instance that you have provisioned. 4. Click on the appropriate bucket that you would like to check 5. Click on Configuration and scroll down to Associated key management service to check/confirm if a Key Protect key management service is associated

修補方式

修補方法: 操作指南或基礎設施修補檔

You will not be able to add Key Protect as the key management service once data is already written to a Cloud Object Storage bucket. In order to ensure that objects are encrypted using Key Protect root keys you will need to create a new Cloud Object Storage bucket, set it to use Key Protect key management service and then upload/copy the existing objects to this new bucket.

屬性

作業系統: 不限
標籤: cloudencryptionibmcloud
參考資料: CIS IBM Cloud Foundations Benchmark v2.0.0 - 2.1.1.2 Ensure Cloud Object Storage Encryption is set to On with BYOK