An evidence-management system must cryptographically protect stored body-worn camera video at rest. What should architects treat as a required information-system capability?
Select an answer to reveal the explanation.
Short Explanation
A locked door helps, but the video bits still need a real crypto wrapper with managed keys. Renaming files or dumping BMPs on a public share is cosplay encryption, not protection.
Full Explanation
An evidence-management system holding body-worn camera video at rest must treat cryptographic protection of stored objects as a required information-system capability, not an optional physical add-on. Architects should require native or integrated encryption/decryption services for stored video—volume, object, or application-level encryption—with managed keys (rotation, access control, separation from the ciphertext, dual control for evidence unlock where policy demands). Screenshotting videos into uncompressed BMP files on a public share expands volume and exposure while abandoning cryptographic confidentiality. Renaming files with random strings is not encryption; filenames are not keys and content remains readable. Relying only on locked server-room doors protects facilities but leaves bytes readable if disks, backups, or cloud replicas leave that room. Exam caveat: CISSP distinguishes physical controls from cryptographic protection of data at rest; regulated evidence often requires both. Operational check: enable encryption on evidence object stores, place keys in KMS/HSM with audited access, verify backups are encrypted, test restore with authorized key access only, and confirm public shares cannot host plaintext video derivatives.