topic Re: CCSP: Cryptoshredding in Tech Talk

CCSP: Cryptoshredding

Spirnia — Wed, 23 Apr 2025 15:24:23 GMT

Hi,

I am wondering about the steps in cryptoshredding.

I was under the impression that you delete the key only.

But, the official online curriculum says the following:

So, is data re-written during cryptoshredding or is only the key destroyed?

Re: CCSP: Cryptoshredding

akkem — Wed, 23 Apr 2025 17:39:22 GMT

I believe there was an initial and end statements for the above message.

For crypto shredding, key removal is typically sufficient. While overwriting the disk may be possible if you have access, it's not usually practical or beneficial in cloud environments. However, for on-premises setups—especially if you plan to reuse the storage device—overwriting could still be worthwhile.

Re: CCSP: Cryptoshredding

Spirnia — Wed, 23 Apr 2025 18:26:44 GMT

I have included more of the excerpt below.

I agree that you need only delete the key.

I do not understand why the official online curriculum erroneously says what it says in addition to deleting the key.

Thank you for your reply!

Re: CCSP: Cryptoshredding

dcontesti — Wed, 23 Apr 2025 19:40:40 GMT

Without access to the exact material, it is difficult to make a judgement call.

I have always understood Crypto Shredding to be a method that renders encrypted data unretrievable by deleting or overwriting the key,

Deleting the key does not necessarily mean that the 1's and 0"s are gone, until something overwrites that space.

MHO: Overwriting the key is a better way to destroy the key and it stands to reason the more times that I override that space, the more I am guaranteed it is gone. Again My Opinion Only.

Others?

Re: CCSP: Cryptoshredding

Spirnia — Wed, 23 Apr 2025 20:17:22 GMT

Thank you for your response!

I asked ChatGPT also and I have included what it had to say below.

Perhaps the definition of cryptoshredding does not account for more than deleting the key.

I am not very familiar with cloud services from AWS, Google, and Azure.

And I wonder if they would allow for the customer to perform a wipe on the drive. I think they handle that on their end and a cryptoshred is all a customer can do.

Re: CCSP: Cryptoshredding

Spirnia — Wed, 23 Apr 2025 20:59:38 GMT

Here is a screenshot of the slide:

Re: CCSP: Cryptoshredding

Spirnia — Wed, 23 Apr 2025 21:24:47 GMT

Here’s the quiz:

Re: CCSP: Cryptoshredding

Steve-Wilme — Thu, 24 Apr 2025 08:05:58 GMT

This is something you should establish before you sign up with your CSP if the data they are hosting is at all sensitive. You will not control the cryptography for all services offered by CSPs e.g. SaaS applications, so it is important to understand what happens to your data once your subscription ends. This may be stated in the agreement with the CSP but you should also examine other evidence such as a SOC2 type 2 and any ISO certifications if available.

Re: CCSP: Cryptoshredding

Spirnia — Thu, 24 Apr 2025 10:32:21 GMT

Yes, I agree with your statement.

It should be discussed before sign up.

Re: CCSP: Cryptoshredding

dcontesti — Thu, 24 Apr 2025 15:54:40 GMT

So I personally disagree with this. With Cryptoshredding, the Key is the only thing touched. The data is not rewritten.

@CBMExamTeam @DJExamTeam Could one of you provide guidance on this training material OR forward to someone that can provide an explanation.

Perhaps a better word for "rewrite" would be protect.

Others?

Re: CCSP: Cryptoshredding

Spirnia — Thu, 24 Apr 2025 16:05:51 GMT

Thank you so much!

Re: CCSP: Cryptoshredding

CBMExamTeam — Thu, 24 Apr 2025 16:12:10 GMT

@dcontesti Hello,

Thank you for reaching out.

I have forwarded your request to the people I hope will be able to help. Either someone will respond via Community or I'll let you know when my resource(s) reply.

Christine

Exam Admin

Exam Security

Re: CCSP: Cryptoshredding

CBMExamTeam — Thu, 24 Apr 2025 22:04:21 GMT

@dcontesti @Spirnia Hello again,

I'm pleased to tell you that two of our content experts (also part of our Standards & Practice team) will be responding to you once they've had the chance to review the discussion here on Community.

Please be patient; you will receive a response.

Christine

Exam Administration

Exam Security

Re: CCSP: Cryptoshredding

Spirnia — Thu, 24 Apr 2025 22:06:03 GMT

Thank you so much!

Re: CCSP: Cryptoshredding

dcontesti — Fri, 25 Apr 2025 00:28:45 GMT

Many thanks for the assist on this one.

Re: CCSP: Cryptoshredding

WillO_317 — Fri, 25 Apr 2025 17:51:11 GMT

Technically, you are on the right track; however, the terms ‘cryptographic erasure’, ‘crypto-shredding’, and ‘digital shredding’ are used somewhat interchangeably. The text muddies the water a bit by the statement "to perform proper crypto-shredding..."

By definition, Crypto-shredding is “A method of Sanitization in which the Media Encryption Key (MEK) for the encrypted Target Data (or the Key Encryption Key –KEK) is sanitized, making recovery of the decrypted Target Data Infeasible” (NIST SP 800-88r1).

Crypto-shredding is not this process, it is merely one portion of a larger cryptographic erasure process.

As an aside, I would disagree that the key is the ‘ONLY thing touched', as that may not be sufficient.

Re: CCSP: Cryptoshredding

WillO_317 — Fri, 25 Apr 2025 18:01:05 GMT

I will also add that ISC2 has marked this one for clarification/correction in its upcoming edits. Thank you for engaging in this discussion.

Re: CCSP: Cryptoshredding

Spirnia — Fri, 25 Apr 2025 19:25:28 GMT

Thank you for providing the definition from NIST.

I didn’t think to look there!