+Cryptography and Key Management (CRY)
---+Policy for the use of encryption procedures and key management
---+Encryption of data for transmission (transport encryption)
---+Encryption of sensitive data for storage
---+Secure key management
|
Cryptography and Key Management (CRY)
None
1. Pregled
| Naslov |
Standard |
|
Policy for the use of encryption procedures and key management
|
Policies and instructions with technical and organisational safeguards for encryption procedures and key management are documented, communicated and provided according to SP-01, in which the following aspects are described:
• Usage of strong encryption procedures and secure network protocols that correspond to the stateofthe-art;
• Riskbased provisions for the use of encryption which are aligned with the information classification schemes (cf. AM06) and consider the communication channel, type, strength and quality of the encryption;
• Requirements for the secure generation, storage, archiving, retrieval, distribution, withdrawal and deletion of the keys; and
• Consideration of relevant legal and regulatory obligations and requirements.
Additonal Criteria-
Supplementary Information - About the CriteriaThe stateofthe-art of strong encryption procedures and secure network protocols is specified in the following BSI Technical Guidelines valid at the given time:
• BSI TR021021 Cryptographic Mechanisms: Recommendations and Key Lengths;
• BSI TR021022 Cryptographic Mechanisms: Use of Transport Layer Security (TLS);
• BSI TR021023 Cryptographic Mechanisms: Use of Internet Protocol Security (IPSec) and Internet Key Exchange (IKEv2); and
• BSI TR021024 Cryptographic Mechanisms: Use of Secure Shell (SSH).
|
|
Encryption of data for transmission (transport encryption)
|
The Cloud Service Provider has established procedures and technical measures for strong encryption and authentication for the transmission of data of cloud customers over public networks.
Additonal CriteriaThe Cloud Service Provider has established procedures and technical measures for strong encryption and authentication for the transmission of all data.
Supplementary Information - About the CriteriaWhen transmitting data with normal protection requirements within the Cloud Service Provider’s infrastructure, encryption is not mandatory provided that the data is not transmitted via public networks. In this case, the nonpublic environment of the Cloud Service Provider can generally be deemed trusted. The protocols TLS 1.2 and TLS 1.3 are currently regarded as strong, stateoftheart transport encryptions, in each case in combination with Perfect Forward Secrecy. The specific configuration should comply with the recommendations of the (current) version of the BSI Technical Guideline TR021022 "Cryptographic Procedures: Recommendations and key lengths. Part 2 - Use of Transport Layer Security (TLS)". Generally, the use of wildcard certificates is not considered a secure procedure.
The basic criterion for the transmission cloud customers' data, relates to e.g. the sending of electronic messages via public networks.
|
|
Encryption of sensitive data for storage
|
The Cloud Service Provider has established procedures and technical safeguards to encrypt cloud customers' data during storage. The private keys used for encryption are known only to the cloud customer in accordance with applicable legal and regulatory obligations and requirements. Exceptions follow a specified procedure. The procedures for the use of private keys, including any exceptions, must be contractually agreed with the cloud customer.
Additonal CriteriaThe private keys used for encryption are known to the customer exclusively and without exception in accordance with applicable legal and regulatory obligations and requirements.
Supplementary Information - About the CriteriaAn exception to the requirement that keys are known only to the cloud customers may be the use of a master key by the Cloud Service Provider. If the Cloud Service Provider established a procedure to use a master key, the Cloud Service Provider must perform sample-based checks regarding the suitability and effectiveness of the procedure, on a regular basis. This criterion does not apply to data that cannot be encrypted for the provision of the cloud service for functional reasons.
|
|
Secure key management
|
Procedures and technical safeguards for secure key management in the area of responsibility of the Cloud Service Provider include at least the following aspects:
• Generation of keys for different cryptographic systems and applications;
• Issuing and obtaining public-key certificates;
• Provisioning and activation of the keys;
• Secure storage of keys (separation of key management system from application and middleware level) including description of how authorised users get access;
• Changing or updating cryptographic keys including policies defining under which conditions and in which manner the changes and/or updates are to be realised;
• Handling of compromised keys;
• Withdrawal and deletion of keys; and
• If pre-shared keys are used, the specific provisions relating to the safe use of this procedure are specified separately.
Additonal Criteria-
Supplementary Information - About the CriteriaKeys should be withdrawn or deleted e.g. in the event of compromise or employee changes. The Cloud Service Provider protects the keys which are created and inserted into the cloud service by the cloud customers according to the same criteria as the keys created by the Cloud Service Provider.
|
1.1 Sklici
1.2 Ugotovljene zahteve
1.3 Povezani predpisi
2. Ugotovljene zahteve
3. Povezani predpisi
|