A company must delete a data set from a public cloud provider, including replicas and backups managed by the provider that the customer cannot reach directly. Which method gives the customer the most assurance that the data is unrecoverable?
Select an answer to reveal the explanation.
Short Explanation
You can't walk into the provider's data center and shred their disks, and you can't reach every replica. What you can do is destroy the encryption keys, and then every copy, wherever it sits, turns into useless noise. That's crypto-shredding, and it's the cloud answer to sanitization.
Full Explanation
In multi-tenant cloud environments, customers cannot physically access media, and data is replicated across devices, facilities and backup systems they cannot address directly. Traditional sanitization methods that depend on media access therefore do not work. Crypto-shredding, also called cryptographic erasure, relies on the data having been encrypted with keys the customer controls. Destroying all copies of those keys renders every copy of the ciphertext, including replicas and backups, computationally unrecoverable, regardless of where the provider stores them. Overwriting from the customer's virtual machines can only affect the logical blocks the customer can address; it cannot reach replicas, backups or blocks the provider has remapped. Degaussing destroys magnetic media, but providers do not degauss shared disks at a customer's request, it does not work on solid-state storage and the customer cannot verify it. Deleting objects through the console removes them logically, but the customer has limited assurance about when or whether every replica and backup is purged. Exam caveat: crypto-shredding only works if the data was encrypted from the start and no other copies of the keys exist, including in key backups. Operational check: verify all key versions and key backups are destroyed and record the destruction event.