A company just learned that the data in its object storage was accessed by an unauthorized party. Which of the following should the company have done…

Encryption at rest is a security control that encodes data stored on a disk or in a storage service, rendering it unreadable without the proper decryption key. If an unauthorized party gains access to the physical storage or the stored files, they would only see ciphertext, which is unusable. This directly addresses the scenario's requirement to make the data unusable to an attacker who has bypassed access controls and accessed the stored objects. This is a fundamental practice for ensuring data confidentiality in the cloud.

A. The company should have switched from object storage to file storage.

This changes the storage architecture but does not inherently secure the data. File storage is also susceptible to unauthorized access if not properly configured and secured.

B. The company should have hashed the data.

Hashing is a one-way function used for integrity verification (e.g., passwords), not for protecting data that needs to be retrieved and used later. Hashing would make the data unusable for everyone.

C. The company should have changed the file access permissions.

This is a preventative access control measure. While crucial, it does not make the data itself unusable if those permissions are bypassed or compromised, as happened in the scenario.

1. National Institute of Standards and Technology (NIST). (2011). NIST Special Publication 800-144: Guidelines on Security and Privacy in Public Cloud Computing.

Section 6.2.1

"Protecting Data in the Cloud

" page 23: "To protect data confidentiality and integrity

organizations should encrypt sensitive data in transit over networks and at rest in storage." This establishes encryption as the standard for protecting data confidentiality.

2. Amazon Web Services (AWS). (2023). Amazon S3 User Guide.

Section: "Protecting data using server-side encryption": "Server-side encryption is the encryption of data at its destination by the application or service that receives it. Amazon S3 encrypts your data at the object level as it writes it to disks in its data centers and decrypts it for you when you access it... protecting your data at rest." This official vendor documentation confirms encryption's role in making stored data unusable without authorization.

3. Microsoft Azure. (2023). Azure Storage encryption for data at rest. Microsoft Learn.

Section: "About Azure Storage encryption": "Data in Azure Storage is encrypted and decrypted transparently using 256-bit AES encryption... Azure Storage encryption protects your data and to help you to meet your organizational security and compliance commitments." This source highlights that encryption is the mechanism for protecting data at rest from unauthorized viewing.