IPF Standard - EBS Encryption (2023-08).docx
DOCX document 280 KB Posted
- Solicitation number
- HM047625R0016_Bidder_Library
About this file
This is an internal standard document establishing encryption requirements for EBS (Elastic Block Storage) volumes within the IPF (Intelligence Program Foundation) cloud environments across all domains. The document, dated July 27, 2023, addresses the historical issue of unencrypted EBS volumes being utilized in production environments, which conflicts with agency cybersecurity best practices. The standard mandates that all new EC2 instances must have storage configured with encryption using either AWS Key Management Service (KMS) default keys or customer-managed KMS keys, with customer-managed keys preferred due to their flexibility for key creation, rotation, and lifecycle management.
For existing unencrypted EBS volumes currently attached to running instances, the document provides a detailed remediation procedure requiring instance shutdown, EBS snapshot creation, encrypted snapshot copying, new encrypted volume creation from the snapshot, and reattachment to the original EC2 instance with matching device naming conventions. The standard applies to both new and legacy infrastructure within the IPF program and references AWS documentation at https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html for additional technical guidance. This standard document serves as an internal policy requirement for the National Geospatial Intelligence Agency's cloud security posture rather than a solicitation for external vendor services or products.
View the file
Other files
Show 40 more
50 files listed here. See the rest on GovTribe.
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
UNCLASSIFIED
IPF Standard EBS Volume Encryption 2023-07-27 Purpose Historically within IPF, monthly data has shown there are a number of unencrypted EBS volumes being used in the cloud environments on all domains. This goes against agency best practices for securing data. The goal of this document is to ensure all new, and existing EBS volumes will be properly encrypted to better improve the security posture of the IPF program going forward.
Standard for EBS Encryption
1. All new EC2 instances that are spun up, need to have storage configured to use encryption. This can be configured in the ‘Advanced’ options of the storage settings when launching an EC2.
2. All new EBS volumes that are created from the EBS console need to be encrypted.
3. A default AWS KMS (Key Management Service) key, or an existing customer managed KMS key can be used for the encryption.
a. Customer managed keys are preferred due to more flexibility, including the ability to create, rotate, and disable KMS keys.
4. All existing unencrypted EBS volumes attached to running instances need to be encrypted. This cannot be done directly.
a. Stop your EC2 instance.
b. Create an EBS snapshot of the volume you want to encrypt.
c. Copy the EBS snapshot, encrypting the copy in the process using either the default AWS KMS, or your customer managed KMS key.
d. Create a new EBS volume from your new encrypted EBS snapshot. The new EBS volume will be encrypted.
e. Detach the original EBS volume and attach your new encrypted EBS volume, making sure to match the device name (/dev/xvda1, etc.)
f. Start the EC2 instance.
Supporting documentation can be found here: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html image3.png image4.png image5.png image6.png image1.png image2.png
File details come from the government source that posted it. Updated .