ISC2 Certified Cloud Security Professional (CCSP) Practice Question

Cryptographic erase is performed by permanently deleting or overwriting the encryption keys that protect data at rest. Because the data on the disks remains encrypted with keys that no longer exist, it becomes computationally infeasible to recover, even though the physical blocks are not overwritten. This method is therefore extremely fast-often completing in seconds-allowing the cloud service provider to return the storage media to the shared pool almost immediately. Traditional logical or physical overwriting methods (single-pass zero fill or multi-pass DoD wipes) require writing to every block, which can take hours and delay media reuse. Degaussing is impractical for provider-owned drives because it destroys the drive's servo information, making the hardware unusable. Only cryptographic erase meets both the security need for irretrievability and the cloud provider's operational need for rapid turnover.