Certified Cloud Security Professional (CCSP)Cloud Concepts, Architecture and DesignHard
A cloud security architect is evaluating different cloud providers for an application that processes highly sensitive personal identifiable information (PII). The primary concern is to minimize the risk of data exposure due to a compromise of the cloud provider's underlying infrastructure or hypervisor. Which security concept or technology would offer the MOST robust protection against this specific threat vector?
- AData Loss Prevention (DLP)
- BVirtualization-aware security
- CConfidential Computing
- DHomomorphic Encryption
Show answer & explanationAnswer & explanation
Correct answer: C. Confidential Computing
Confidential Computing protects data in use by performing computation within a hardware-based trusted execution environment (TEE), making it inaccessible to the cloud provider, hypervisor, or other tenants, even if the underlying infrastructure is compromised. This directly addresses the risk of data exposure from a compromised hypervisor.
Why the other options are wrong
- A. DLP focuses on preventing data exfiltration, not protecting data from a compromised hypervisor accessing data in memory.
- B. Virtualization-aware security helps protect VMs but doesn't inherently prevent a compromised hypervisor from accessing VM memory.
- D. Homomorphic Encryption allows computation on encrypted data but is typically computationally expensive and not for general runtime protection against hypervisor compromise.
Confidential Computing
A cloud security technology that protects data in use by performing computation in a hardware-based Trusted Execution Environment (TEE), shielding it from unauthorized access even from the cloud provider.
- Protects data during processing (in use).
- Utilizes hardware-based Trusted Execution Environments (TEEs).
- Shields data from hypervisor, OS, and cloud administrator access.
Memory trick: At Rest, In Transit, In Use: Data needs protection in every phase.