An organization stores Copilot agent memory in a cloud-hosted vector database to enable long-term context retrieval. A security audit finds that the vector embeddings and raw text chunks are stored unencrypted at rest, and the database is accessible using a single shared API key stored in a plain-text configuration file. Which two controls are most critical to implement immediately?
Select an answer to reveal the explanation.
Short Explanation and Infographic
An unencrypted database with a plaintext shared key is like storing sensitive files in an unlocked cabinet with the key taped to the front. Encryption at rest protects the data if the storage medium is compromised, and secrets manager credentials ensure each service gets its own revocable, short-lived access—two completely independent attack surface reductions.
Full explanation below image
Full Explanation
The audit identified two distinct vulnerabilities that require independent mitigations:
Vulnerability 1: Unencrypted data at rest Vector embeddings and raw text chunks may contain sensitive organizational content (code, internal discussions, customer data). If the underlying storage is accessed by a threat actor (cloud storage breach, rogue cloud provider employee, misconfigured bucket), plaintext data is immediately readable. Encryption at rest using AES-256, ideally with customer-managed keys (CMK) in a key management service, ensures that even raw storage access yields unreadable ciphertext.
Vulnerability 2: Shared plaintext API key A single shared key stored in a plaintext configuration file has several compounding problems: (a) any process or person who can read the config file gets full database access, (b) rotating the key requires updating every service simultaneously, (c) there is no per-service audit trail—all access looks identical. Replacing this with per-service credentials from a secrets manager (e.g., GitHub Actions secrets, HashiCorp Vault, AWS Secrets Manager) allows individual service revocation, rotation on schedule, and attribution in access logs.
Option A (compression and pagination) addresses operational efficiency, not security. Option C (TLS and longer key) improves transit security and credential entropy, but encryption in transit is already industry standard—the audit found at-rest and access control gaps, not transit gaps. A 256-character key is better than a short one but still suffers all the problems of being shared and plaintext. Option D (read-only + human approval) addresses write authorization but doesn't encrypt the data or fix the credential problem.