Ensure boot volumes are encrypted with Customer managed keys

中等級 2人工審核ibmcloud

說明

By default, IBM Cloud® Block Storage for Virtual Private Cloud provides provider- managed encryption for all data. For enhanced security, customers can bring their own encryption keys and manage them through IBM Key Management Services – Key Protect or Hyper Protect Crypto Services (HPCS). With customer-managed keys, only customers can access and manage their master root keys, giving them full control over their data security.

檢查方式

稽核方法: 人工審核

此項建議無法自動檢查。當您傳入 --include-manual 時，掃描結果會列出此項目並附帶這些說明。

You can use the IBM® Cloud Block Storage for Virtual Private Cloud configuration properties to verify whether a block volume is enabled to use Key Protect or Hyper Protect key management services. From Console, Navigate to your block volume resource: 1. In the IBM Cloud console, go to Menu icon, VPC Infrastructure, Storage, Block storage volumes. A list of all block storage volumes displays. 2. For each volumes listed with Attachment Type column value Boot, ensure the encryption field is Not pointing to Provider Managed.

修補方式

修補方法: 操作指南或基礎設施修補檔

You will not be able to change encryption option once data is already written to a Cloud Block Storage Volume. In order to ensure that data is encrypted using customer managed keys you will need to create a new Cloud Block Storage volume, set it to use either Key Protect or Hyper Protect key management service and then upload/copy the existing objects to this new volume.

屬性

作業系統: 不限
標籤: cloudcryptoencryptionibmcloud
參考資料: CIS IBM Cloud Foundations Benchmark v2.0.0 - 2.2.3 Ensure boot volumes are encrypted with Customer managed keys