Data at riskKMS key is anonymously/publicly accessible
Platform(s)
Compliance Frameworks
- CCM-CSA ,
- Data Security Posture Management (DSPM) Best Practices ,
- GCP CIS ,
- iso_27001_2022 ,
- iso_27002_2022 ,
- Mitre ATT&CK ,
- mpa ,
- New Zealand Information Security Manual ,
- NIST 800-171 ,
- NIST 800-53
Description
Granting permissions to allUsers or allAuthenticatedUsers allows anyone to access the dataset. Such access might not be desirable if sensitive data is stored at the location. In this case, ensure that anonymous and/or public access to a Cloud KMS cryptokey is not allowed.
Demo the Orca Platform
In just 10 minutes, you’ll see how Orca Security can revolutionize your cloud security strategy. Watch a recorded demo from a cloud security expert now.