Securing Your Critical Workloads with IBM Hyper Protect Services
Total Page:16
File Type:pdf, Size:1020Kb
Front cover Securing Your Critical Workloads with IBM Hyper Protect Services Barry Silliman Sandeep Sarkar Diana Henderson Sarath Chandra Mekala Elton de Souza Vasfi Gucer Jin VanStee Qi Ye Jordan Cartwright Madhuri Gangireddy Matt Mondics Matthew Arnold Ravi Kumar Gullapalli Sandeep Ambekar Redbooks IBM Redbooks Securing Your Critical Workloads with IBM Hyper Protect Services March 2020 SG24-8469-00 Note: Before using this information and the product it supports, read the information in “Notices” on page vii. First Edition (March 2020) This edition applies to IBM Hyper Protect Virtual Servers V1.2.0, IBM Hyper Protect Crypto Services V1.0.0 and IBM Hyper Protect DBaaS V1.0.0 © Copyright International Business Machines Corporation 2020. All rights reserved. Note to U.S. Government Users Restricted Rights -- Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp. Contents Notices . vii Trademarks . viii Preface . ix Authors. .x Now you can become a published author, too! . xiii Comments welcome. xiii Stay connected to IBM Redbooks . xiv Chapter 1. Introduction to IBM Hyper Protect Services . 1 1.1 Industry and IBM Hyper Protect Services portfolio overview . 2 1.2 Hyper Protect Crypto Services . 2 1.3 Hyper Protect Database as a Service . 3 1.4 Hyper Protect Virtual Servers . 4 1.5 Hyper Protect Virtual Servers (on-premises). 5 1.5.1 Building images with integrity: Securing continuous integration and continuous delivery . 6 1.5.2 Managing infrastructure with least privilege access to applications and data. 6 1.5.3 Deploying images with trusted provenance . 6 1.6 Security features . 6 1.6.1 Cryptography . 7 1.6.2 IBM Secure Service Container . 9 Chapter 2. IBM Cloud Hyper Protect Crypto Services. 29 2.1 Overview . 30 2.2 Creating an instance of Hyper Protect Crypto Services on the public IBM Cloud. 30 2.2.1 Creating an instance by using the IBM Cloud console . 31 2.2.2 Getting your service instance ready for use . 37 2.3 Using the Key Management Services feature of Hyper Protect Crypto Services . 59 2.3.1 Creating a root key . 59 2.3.2 Creating a standard key . 64 2.3.3 Wrapping a standard key . 66 2.3.4 Unwrapping a standard key . 67 2.3.5 Importing a key as a root key . 68 2.3.6 Importing a key as a standard key . 71 2.3.7 Listing all keys. 74 2.3.8 Listing a specific key . 78 2.4 Using the GREP11 feature of Hyper Protect Crypto Services . 81 2.4.1 Functions available with the GREP11 API . 83 2.5 Code examples . 86 2.5.1 Setting up the GREP11 API . 86 2.5.2 GREP11 code examples. 86 2.6 Hyper Protect Crypto Services use cases. 92 2.6.1 Protecting IBM Cloud services . 92 2.6.2 Using the GREP11 API. 93 Chapter 3. IBM Cloud Hyper Protect DBaaS. 95 3.1 Introduction to IBM Cloud Hyper Protect DBaaS . 96 3.2 Sizing and topology. 97 © Copyright IBM Corp. 2020. All rights reserved. iii 3.3 Public Cloud Service instantiation. 98 3.3.1 Prerequisites . 98 3.3.2 Web Interface . 98 3.3.3 IBM Cloud CLI. 100 3.3.4 Hyper Protect DBaaS RESTful API. 103 3.4 Administration and operations. 105 3.4.1 Managing a Hyper Protect DBaaS Service. 105 3.4.2 Managing database instances . 106 3.4.3 Managing database users. 106 3.4.4 Logging and monitoring . 107 3.4.5 Back up and restore . 111 3.5 Security and compliance . 114 3.6 Use case: Encrypting databases with your keys protected. 114 3.7 API interaction and code samples. 115 3.7.1 Cloning the GitHub example Python code . 116 3.7.2 Setting up a Python virtual environment with requests . 116 3.7.3 Running the example file . 117 Chapter 4. IBM Cloud Hyper Protect Virtual Servers. 119 4.1 Introduction to IBM Cloud Hyper Protect Virtual Servers . 120 4.2 IBM Cloud Hyper Protect Virtual Servers use cases. 120 4.3 Public Cloud service instantiation . 121 Chapter 5. IBM Hyper Protect Virtual Servers on-premises . 125 5.1 Introduction to IBM Hyper Protect Virtual Servers on-premises . 126 5.2 IBM Hyper Protect Virtual Servers key features . 127 5.2.1 Trusted CI/CD . 128 5.2.2 GREP11 . 129 5.2.3 User management . 130 5.2.4 Bring Your Own Image . 130 5.2.5 Encryption . 130 5.3 IBM Hyper Protect Virtual Servers use cases . 131 5.4 IBM Hyper Protect Virtual Servers architecture overview . 133 5.5 A sample use case: Hyper Protect Virtual Server for secure storage . 138 5.5.1 Creating a Secure Storage Server in Hyper Protect Virtual Servers. 140 Chapter 6. IBM Hyper Protect.