Rule ID
SV-286203r1292192_rule
Version
V1R1
CCIs
This control is intended to address the confidentiality and integrity of information at rest in nonmobile devices and covers user information and system information. Information at rest refers to the state of information when it is located on a secondary storage device (e.g., disk drive, tape drive) within an organizational information system. Applications and application users generate information throughout the course of their application use. User-generated data and application-specific configuration data must be protected. Organizations may choose to employ different mechanisms to achieve confidentiality and integrity protections, as appropriate. If the confidentiality and integrity of application data is not protected, the data will be open to compromise and unauthorized modification.
If the application owner and Authorizing Official (AO) have determined that encryption of data at rest is not required, this is not a finding. If full-disk encryption is being used, and the DBA or system administrator (SA) can demonstrate the use of disk-level encryption, this is not a finding. One possible way to encrypt data within MariaDB is to use the file key management plugin. To determine if this is installed, check the following variables as the DBA: SHOW PLUGINS; Confirm the "file_key_management.so" is listed. SHOW GLOBAL VARIABLES LIKE 'file_key%'; SHOW GLOBAL VARIABLES LIKE 'aria_en%'; SHOW GLOBAL VARIABLES LIKE 'innodb_encrypt_tables'; SHOW GLOBAL VARIABLES LIKE 'innodb_encrypt_log'; SHOW GLOBAL VARIABLES LIKE 'innodb_tablespace%'; SHOW GLOBAL VARIABLES LIKE 'encrypt%'; Confirm these are set to "ON". If this is required and is not found, this is a finding. If controls do not exist or are not enabled, this is a finding.
MariaDB data-at-rest encryption requires the use of a key management and encryption plugin. These plugins manage encryption keys and perform the encryption and decryption of data. MariaDB supports the use of multiple encryption keys. Each encryption key uses a 32-bit integer as a key identifier. If the selected plugin supports key rotation, encryption keys may also be rotated, creating a new version of the encryption key. The File Key Management plugin included with MariaDB is a key management and encryption plugin that reads encryption keys from a plain-text file. Although the plugin’s shared library is distributed with MariaDB by default, the plugin is not installed by default. The plugin can be installed by specifying the "--plugin-load" or "--plugin-load-add" options. This may be provided as a command-line argument to "mysqld" or specified in a server option group in a configuration file. For example: [mariadb] plugin_load_add = file_key_management To encrypt tables using the File Key Management plugin, create a file containing the encryption keys. The file must contain two pieces of information for each encryption key: - A 32-bit integer used as the encryption key identifier. - The encryption key provided in hex-encoded form. These values must be separated by a semicolon. The file format should appear as follows: <encryption_key_id1>;<hex-encoded_encryption_key1> <encryption_key_id2>;<hex-encoded_encryption_key2> The key file may optionally be encrypted to reduce accessibility from the file system. The File Key Management plugin uses the Advanced Encryption Standard (AES) algorithm and supports 128-bit, 192-bit, and 256-bit encryption keys. Random encryption keys can be generated using the "openssl rand" command. For example, to generate a random 256-bit (32-byte) encryption key: $ openssl rand -hex 32 a7addd9adea9978fda19f21e6be987880e68ac92632ca052e5bb42b1a506939a Encryption keys can be appended to the key file. For example: $ sudo openssl rand -hex 32 >> /etc/mysql/encryption/keyfile $ sudo openssl rand -hex 32 >> /etc/mysql/encryption/keyfile $ sudo openssl rand -hex 32 >> /etc/mysql/encryption/keyfile After generating keys, the key file may appear as follows: a7addd9adea9978fda19f21e6be987880e68ac92632ca052e5bb42b1a506939a 49c16acc2dffe616710c9ba9a10b94944a737de1beccb52dc1560abfdd67388b 8db1ee74580e7e93ab8cf157f02656d356c2f437d548d5bf16bf2a56932954a3 Each encryption key must include a key identifier at the beginning of the line. Key identifiers do not need to be contiguous. After adding identifiers, the key file may appear as follows: 1;a7addd9adea9978fda19f21e6be987880e68ac92632ca052e5bb42b1a506939a 2;49c16acc2dffe616710c9ba9a10b94944a737de1beccb52dc1560abfdd67388b 100;8db1ee74580e7e93ab8cf157f02656d356c2f437d548d5bf16bf2a56932954a3 The key identifiers provide a method to reference encryption keys from MariaDB. For example, encryption keys may be referenced using identifiers such as 1, 2, or 100 through the "ENCRYPTION_KEY_ID" table option or system variables such as "innodb_default_encryption_key_id". The encryption key with identifier 1 is the only mandatory encryption key. Once the File Key Management plugin is enabled, encrypted tables may be created using the following statement: CREATE TABLE t (i INT) ENGINE=InnoDB ENCRYPTED=YES; Then, the table is encrypted using the encryption key specified in the key file.