Reporting analysts query a cloud database whose records are encrypted at rest. To compute results, the reporting engine decrypts records and holds them in memory while processing. Which statement best describes the risk in this phase of the data lifecycle and an appropriate control?
Select an answer to reveal the explanation.
Short Explanation
Encryption at rest is a locked safe, but you have to open the safe to actually read the papers. In the Use phase the data sits in memory in the clear, so you need tight access, good monitoring, and maybe a trusted execution environment. Don't fall for 'it's encrypted at rest, so we're covered.'
Full Explanation
The Use phase is where data is viewed, processed or otherwise acted on, and in most systems that requires the data to be decrypted. Records encrypted at rest are decrypted when read, and the reporting engine then holds cleartext in memory, which exposes it to privileged users, compromised processes, memory scraping and co-resident threats. Appropriate controls focus on who and what can touch the data while it is in use: least-privilege access, strong authentication, activity monitoring and logging of queries, plus confidential computing, which uses hardware-based trusted execution environments to protect data in memory during processing. Claiming the data stays encrypted during processing is incorrect for conventional systems; encryption at rest protects storage media, not active computation. TLS protects data in transit between the analyst's client and the database, which is a different state from data held in the engine's memory. Crypto-shredding is a destruction technique that destroys keys so data becomes unrecoverable; applying it after every query would destroy the dataset and is not a Use phase control. Exam caveat: homomorphic encryption exists but is not a general-purpose answer. Operational check: confirm query access is restricted to named roles and that data access events are logged and reviewed.