Certified Cloud Security Professional (CCSP)Cloud Platform and Infrastructure SecurityMedium
A cloud service provider (CSP) is offering a new object storage service. A client is particularly concerned about the integrity of their archived data, ensuring that it has not been tampered with or altered over long periods. Which of the following security controls, when applied to the object storage, would BEST address the client's concern about data integrity?
- AVersioning and immutable object storage policies.
- BServer-side encryption with customer-provided keys (SSE-C).
- CStrict access control policies (IAM) on storage buckets.
- DCross-region replication for disaster recovery.
Show answer & explanationAnswer & explanation
Correct answer: A. Versioning and immutable object storage policies.
Versioning allows for the retrieval of previous versions of an object, effectively protecting against accidental deletion or modification. Immutable object storage policies, often 'Write Once, Read Many' (WORM), prevent objects from being overwritten or deleted for a specified retention period, directly addressing concerns about data tampering and long-term integrity.
Why the other options are wrong
- B. SSE-C protects data confidentiality but does not inherently prevent an authorized user from modifying or deleting the data, nor does it track changes.
- C. Strict IAM policies control who can access and modify data, which is foundational, but they don't provide a built-in mechanism to recover from authorized but erroneous modifications or to prove non-tampering over time.
- D. Cross-region replication provides high availability and disaster recovery by copying data to another region, but it replicates changes, including malicious ones, and does not inherently protect against tampering of the original data.
Immutable Object Storage
A storage feature that prevents an object from being overwritten or deleted for a specified period, typically used for regulatory compliance and data integrity.
- Ensures data integrity over time.
- Often called WORM (Write Once, Read Many).
- Critical for compliance and archival.
Memory trick: Version your objects and make them immutable to keep their story true.