Certified Cloud Security Professional (CCSP)Cloud Data SecurityHard
A company is required by law to delete all customer data related to a specific service 90 days after the customer terminates their subscription. To ensure compliance, they need a robust method to permanently destroy this data across all cloud storage locations, including backups and archives, making it irrecoverable. Which data destruction method is most appropriate for this requirement?
- AData Wiping
- BLogical Deletion (Delete Command)
- CCryptographic Erasure
- DPhysical Destruction
Show answer & explanationAnswer & explanation
Correct answer: C. Cryptographic Erasure
Cryptographic erasure, often performed by deleting or revoking the encryption key used to encrypt the data, renders the encrypted data permanently irrecoverable. This is highly effective in cloud environments where physical destruction of underlying media is not feasible for customers, and it works across various storage types including backups and archives, provided they were encrypted with that specific key.
Why the other options are wrong
- A. Data wiping overwrites data multiple times and is typically for physical media, difficult to guarantee in a multi-tenant cloud.
- B. Logical deletion merely marks data as deleted, making it recoverable with forensics.
- D. Physical destruction is for hardware media, which cloud customers cannot perform on shared cloud infrastructure.
Cryptographic Erasure
A data destruction method that renders data irrecoverable by deleting or revoking the encryption key(s) used to encrypt the data, effectively making the encrypted data useless without the key.
- Destroys the encryption key, not the data directly.
- Renders encrypted data permanently irrecoverable.
- Highly effective in cloud and virtualized environments.
- Verifiable by checking key status.
Memory trick: Logical hides, Wiping overwrites, Crypto locks, Physical smashes.