[Lightning CM-03-06] Cryptographic Configuration Management ¶
1. Control Objective ¶
Ensure that all cryptographic mechanisms used by the application are managed under configuration management and that all changes are properly reviewed, approved, and auditable.
2. Cryptographic Mechanisms in Scope ¶
The application uses the following cryptographic mechanisms:
| Component | Cryptographic Mechanism | Purpose | Location | Configuration Management |
|---|---|---|---|---|
| HTTPS Communication | TLS 1.2 / TLS 1.3 | Secure communication between users and application | AWS CloudFront | Managed via AWS configuration and deployment pipeline |
| SSL Certificates | X.509 Certificates | Secure HTTPS connections | AWS Certificate Manager (ACM) | Managed through AWS ACM |
| Database Encryption | AES-256 (KMS) | Encryption at rest | AWS RDS | Managed via AWS configuration |
| Cache Encryption | TLS Encryption | Secure Redis communication | AWS ElastiCache | Managed via AWS configuration |
| Password Storage | bcrypt hashing | Secure password storage | Application (Spring Boot) | Managed via Git version control |
| Configuration Secrets | Encrypted parameters | Secure storage of DB credentials and application secrets | AWS Systems Manager Parameter Store | Managed via AWS Parameter Store with encryption enabled |
All mechanisms use industry-standard cryptography and are centrally managed.
3. Configuration Management Approach ¶
All cryptographic configurations are managed under the standard configuration management process.
3.1 Version Control ¶
- All application code and configurations are stored in Git
- Changes are tracked via commit history
3.2 Change Control Process ¶
All cryptographic-related changes follow:
- Change is implemented in code or configuration
- Pull Request (PR) is created
- PR is reviewed and approved
- CI/CD pipeline deploys the change
- Deployment and configuration changes are logged
3.3 Infrastructure Management ¶
- AWS services (CloudFront, RDS, ElastiCache, ACM) are used for encryption
- Configuration changes are controlled via AWS console
- Access is restricted via IAM roles
4. Definition of Cryptographic Changes ¶
The following are considered cryptographic changes:
- TLS version or cipher suite updates
- Certificate issuance, renewal, or rotation
- Database or cache encryption configuration changes
- Secret / key rotation (e.g., JWT secret, API keys)
- Changes to hashing or encryption algorithms
5. Cryptographic Change Management Process ¶
All cryptographic changes must follow this process:
Step 1 – Change Initiation ¶
- Change is proposed (security improvement, rotation, etc.)
Step 2 – Implementation ¶
- Code/configuration updated in Git or AWS
Step 3 – Review & Approval ¶
- PR reviewed by authorized personnel (e.g., Tech Lead / Security)
Step 4 – Deployment ¶
- Change deployed via CI/CD pipeline or AWS configuration
Step 5 – Record Retention ¶
- Change is recorded via:
- Git commit history
- PR approval
- Deployment logs
- AWS configuration logs
6. Cryptographic Change Record (Evidence) ¶
Example 1 – SSL Certificate Upgrade ¶
| Field | Details |
|---|---|
| Change | SSL Certificate re-import and update |
| Reason | Certificate renewal / security compliance |
| Date | 2026-02-02 |
| Approved By | Infrastructure / Security Team |
| Implemented By | DevOps Engineer |
| Implementation Details | Certificate re-imported into AWS Certificate Manager (ACM) and associated with CloudFront distribution |
| Evidence | AWS ACM configuration record, deployment change log |
Example 2 – Redis (Cache) Security Upgrade ¶
| Field | Details |
|---|---|
| Change | Redis version upgrade |
| Reason | Address known security vulnerabilities |
| Date | 2025-10-20 |
| Approved By | Engineering Lead |
| Implemented By | DevOps Engineer |
| Implementation Details | AWS ElastiCache Redis cluster upgraded to a newer version with security patches |
| Evidence | AWS ElastiCache configuration, maintenance/upgrade record |
7. Evidence Sources ¶
The following artifacts provide audit evidence:
| Evidence Type | Location |
|---|---|
| Source code changes | Git repository |
| Approval records | Pull Requests |
| Deployment logs | CI/CD pipeline (Jenkins) |
| Infrastructure changes | AWS Console / Config |
| Secret updates | AWS Secrets Manager |
All records are retained and auditable.
8. Compliance Statement ¶
All cryptographic mechanisms used by the Status Page system are managed under configuration management processes.
Changes to cryptographic configurations require review and approval and are recorded with sufficient detail to ensure traceability, including implementation details and associated approvals.
This satisfies the requirements of Lightning CM-03-06.