CCSP: Cryptoshredding

[Spirnia]

Hi, 

I am wondering about the steps in cryptoshredding.

I was under the impression that you delete the key only.

But, the official online curriculum says the following:

So, is data re-written during cryptoshredding or is only the key destroyed?

[akkem]

I believe there was an initial and end statements for the above message. 

For crypto shredding, key removal is typically sufficient. While overwriting the disk may be possible if you have access, it's not usually practical or beneficial in cloud environments. However, for on-premises setups—especially if you plan to reuse the storage device—overwriting could still be worthwhile.

[Spirnia]

I have included more of the excerpt below.

I agree that you need only delete the key.

I do not understand why the official online curriculum erroneously says what it says in addition to deleting the key.

Thank you for your reply!

[dcontesti]

Without access to the exact material, it is difficult to make a judgement call.

I have always understood Crypto Shredding to be a method that renders encrypted data unretrievable by deleting or overwriting the key,

Deleting the key does not necessarily mean that the 1's and 0"s are gone, until something overwrites that space.

MHO:  Overwriting the key is a better way to destroy the key and it stands to reason the more times that I override that space, the more I am guaranteed it is gone. Again My Opinion Only.

Others?

d

[Spirnia]

Thank you for your response!

I asked ChatGPT also and I have included what it had to say below.

Perhaps the definition of cryptoshredding does not account for more than deleting the key.

I am not very familiar with cloud services from AWS, Google, and Azure.

And I wonder if they would allow for the customer to perform a wipe on the drive. I think they handle that on their end and a cryptoshred is all a customer can do.

[Spirnia]

Here is a screenshot of the slide:

[Spirnia]

Here’s the quiz:

[Steve-Wilme]

This is something you should establish before you sign up with your CSP if the data they are hosting is at all sensitive.  You will not control the cryptography for all services offered by CSPs e.g. SaaS applications, so it is important to understand what happens to your data once your subscription ends.  This may be stated in the agreement with the CSP but you should also examine other evidence such as a SOC2 type 2 and any ISO certifications if available.

[Spirnia]

Yes, I agree with your statement.

It should be discussed before sign up.

[dcontesti]

So I personally disagree with this.  With Cryptoshredding, the Key is the only thing touched.  The data is not rewritten.

@CBMExamTeam  @DJExamTeam Could one of you provide guidance on this training material OR forward  to someone that can provide an explanation.

Perhaps a better word for "rewrite" would be protect.

Others?

d