A sheriff's office stores cloud backup images that could be stolen with the storage media. What control makes the backup data at rest unreadable to an unauthorized holder of that media?
Select an answer to reveal the explanation.
Short Explanation
Encryption is the locked briefcase. Even if someone walks off with the drive, the contents stay gibberish without the keys. Renaming cleartext files does not give you that protection.
Full Explanation
Encrypting backup data at rest protects confidentiality if cloud backup images, snapshots, or media are stolen or exposed. For a sheriff’s office, that control ensures an unauthorized holder of the storage media cannot read sensitive investigative or operational backups without the keys. Encryption is a baseline civic safeguard when criminal-justice data leaves the primary production perimeter in backup form.
Storing backups in cleartext but renaming files only obscures casual browsing and fails against motivated disclosure. Disabling checksums to speed jobs weakens integrity detection and does nothing for confidentiality. Granting every help-desk account full decrypt permission for convenience broadens insider and credential-theft risk and undermines key control.
Exam caveat: encryption at rest is necessary but not sufficient—key management, access to KMS/CMKs, and encryption in transit for backup streams also matter. Losing keys can make backups unrestorable.
Operational check: confirm backup targets use server-side or client-side encryption with keys in a managed vault, restrict decrypt permissions to break-glass and backup admin roles, test a restore that proves keys are available to authorized recovery procedures, and inventory which sheriff’s datasets are covered. Rotate keys per policy and audit decrypt events.