ISC2 CISSP (Certified Information Systems Security Professional)Asset SecurityMedium
A cloud service provider (CSP) offers various storage services to its clients. A client stores highly sensitive financial transaction data with the CSP but requires full control over the encryption and decryption processes, including key management. Which of the following models BEST describes this client's requirement?
- ACSP-managed encryption keys
- BCloud-managed security posture
- CClient-side encryption (CSE)
- DBring Your Own Key (BYOK)
Show answer & explanationAnswer & explanation
Correct answer: C. Client-side encryption (CSE)
Client-side encryption (CSE) means the client encrypts the data before sending it to the CSP for storage. This ensures the client retains full control over the encryption process, including key generation and management, and the CSP never sees the data in an unencrypted state. BYOK allows the client to provide their keys to the CSP, but the CSP still performs the encryption/decryption.
Why the other options are wrong
- A. CSP-managed keys mean the CSP handles all aspects of encryption and key management, which contradicts the client's requirement for full control.
- B. Cloud-managed security posture is a broader concept related to the CSP's overall security services, not specifically key management and encryption control.
- D. BYOK allows the client to generate and supply keys, but the CSP often performs the encryption/decryption using those keys, not giving the client *full* control over the process itself.
Client-Side Encryption (CSE)
A method where data is encrypted by the client's application or system before it is transmitted to and stored by a cloud service provider, ensuring the client retains full control over the encryption keys and process.
- Data is encrypted before leaving the client's control.
- CSP never has access to unencrypted data or encryption keys.
- Provides the highest level of client control over data confidentiality in the cloud.
Memory trick: Client's hand encrypts before cloud land.