Add in new object storage controls on encryption for impact and replication to untrusted destinations #305
Conversation
…cation to untrusted destinations
|
@nas-hub @rowan-baker - can you please take a look at these two proposed controls |
services/storage/object/controls.md
Outdated
|
|
||
| The following validations must be performed against corresponding Control Implementation capabilities to ensure the Control Objective is thoroughly assessed: | ||
|
|
||
| 1. [**CCC.OS.C8.TR01**]{#CCC.OS.C8.TR.01}: Verify that access policies for cloud storage buckets and objects prevent requests with untrusted KMS keys. |
There was a problem hiding this comment.
Assuming untrusted KMS keys here refer to keys in non prod environments or keys in cloud tenants/projects that have Chinese-wall around it. The actual test will be, while configuring the cloud storage with corresponding key store, to check is the provided key store meets rules like same environment, project, folder etc.
|
|
||
| 1. [**CCC.OS.C8.TR01**]{#CCC.OS.C8.TR.01}: Verify that access policies for cloud storage buckets and objects prevent requests with untrusted KMS keys. | ||
|
|
||
| ## CCC.OS.C9: Prevent Replication to Untrusted Destinations |
There was a problem hiding this comment.
How can we define Untrusted destinations: Will this be a list of Services, list of geographies, list of thirdparties etc. If it is geographies then there is a scope to merge this with C7, where in we can expand C7 to include backups to be also blocked in restricted regions and zones.
We need to define "Untrusted Destinations"
There was a problem hiding this comment.
Thinking here is that untrusted destinations (resources) are any that exist outside of a defined identity/network perimeter (e.g.) at the organization level. E.g. if targeted destination/resource is not within a member project/account/subscription within the org, then deny.
There was a problem hiding this comment.
Got it, we may need to have a glossary of terms we use in CCC and define its scope. Or probably just qualify the untrusted destination further contracting it with Trusted Identity Perimeter, Truster Network Perimeter similar to the term Trusted Computing Base defined in NIST/ISC2.
The control and testing requirement LGTM
|
@damienjburks @eddie-knight can you please review/approve if you haven't already - I've just added in an extra line of detail on what we mean by untrusted resource/untrusted perimeters based on feedback from @nas-hub |
Need to work on tests, but would like to get to initial feedback on control objectives first