Skip to main content

Non-encrypted hard drives

Description​

Disk or hard drives without encryption, leave data stored on a computer or network storage system unprotected. Full disk encryption is a great way to protect sensitive customer data.

Impact​

  • Access to company sensitive information
  • Modify or delete the information stored in the disks

Recommendation​

Set the encrypted property for all the hard drives instances defined as code.

Threat​

Authenticated attacker with local access to the machine

Expected Remediation Time​

⌚ 60 minutes.

Score​

Default score using CVSS 3.1. It may change depending on the context of the vulnerability.

Base​

  • Attack vector: L
  • Attack complexity: H
  • Privileges required: L
  • User interaction: N
  • Scope: U
  • Confidentiality: L
  • Integrity: L
  • Availability: L

Temporal​

  • Exploit code madurity: P
  • Remediation level: O
  • Report confidence: C

Result​

  • Vector string: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
  • Score:
    • Base: 4.5
    • Temporal: 4.1
  • Severity:
    • Base: Medium
    • Temporal: Medium

Code Examples​

Compliant code​

All storing resources are securely configured through the use of encryption

Resources:
  NewVolume1:
    Type: AWS::EC2::Volume
    Properties:
      Size: 100
      Encrypted: true
      KmsKeyId: arn:aws:kms:us-east-1:012345678910:alias/ExampleAlias
      AvailabilityZone: us-east-1
    DeletionPolicy: Snapshot

Non compliant code​

Some storing services are unencrypted

Resources:
  NewVolume1:
    Type: AWS::EC2::Volume
    Properties:
      Size: 100
      Encrypted: false
      AvailabilityZone: us-east-1
    DeletionPolicy: Snapshot
resource "aws_instance" "project-iac" {
  ami                         = lookup(var.awsprops, "ami")
  instance_type               = lookup(var.awsprops, "itype")
  subnet_id                   = lookup(var.awsprops, "subnet")
  associate_public_ip_address = lookup(var.awsprops, "publicip")
  key_name                    = lookup(var.awsprops, "keyname")


  vpc_security_group_ids = [
    aws_security_group.project-iac-sg.id
  ]

  root_block_device {
    encrypted             = false
    delete_on_termination = true
    iops                  = 150
    volume_size           = 50
    volume_type           = "gp2"
  }

  ebs_block_device {
    delete_on_termination = true
    iops                  = 150
    volume_size           = 50
    volume_type           = "gp2"
  }
}

Using the AWS CLI, the following command checks if an EBS volume has encryption enabled

$ aws ec2 describe-volumes
      --filters Name=attachment.instance-id, Values= {storage_id}

The command outputs the following structure

{
  "Volumes": [
    {
      "AvailabilityZone": "us-east-1a",
      "Attachments": [
        {
          "AttachTime": "2016-04-04T16:51:00.000Z",
          "InstanceId": "i-67988ffd",
          "VolumeId": "vol-f0e0ee2e",
          "State": "attached",
          "DeleteOnTermination": true,
          "Device": "/dev/xvda"
        }
      ],
      "Encrypted": false,
      "VolumeType": "gp2",
      "VolumeId": "vol-f0e0ee2e",
      "State": "in-use",
      "Iops": 90,
      "SnapshotId": "snap-12c47a84",
      "CreateTime": "2016-04-04T16:51:00.136Z",
      "Size": 30
    }
  ]
}

If the "Encrypted" attribute is set to "false", the EBS volume does not enable encryption

Requirements​

free trial

Search for vulnerabilities in your apps for free with our automated security testing! Start your 21-day free trial and discover the benefits of our Continuous Hacking Machine Plan. If you prefer a full service that includes the expertise of our ethical hackers, don't hesitate to contact us for our Continuous Hacking Squad Plan.