| 🏠 Back to Exam Syllabus | 📺 RooCloud on YouTube | 🌐 RooCloud Practice Exams |
CISSP 20.3 - Storage Threats
This episode of the ISC2 Certified Information Systems Security Professional (CISSP) exam prep series looks past the database to the raw storage beneath it, part of Domain 8. It shows why a perfectly locked application still fails if the disk hangs open, covering the threats to memory and media and the controls that protect data all the way down.
What this episode covers
- Why database security is not enough — a management system guards only the front-door channels while data rests in storage.
- Illegitimate access to storage — intruders browsing an unprotected file system or reading physical media directly.
- Encrypted file systems — the strongest defense, reachable only through the primary operating system.
- Multilevel storage isolation — controlling shared memory so a lower level cannot read a higher one.
- Cloud storage misconfiguration — how one careless toggle can expose a private bucket to the whole internet.
- Locking cloud down by default — strong default settings that restrict public access, with monitoring for change.
- Covert storage channels — leaking data across levels by manipulating shared space, free disk space, or file size.
Watch the full episode above for the worked examples and detailed explanations of each concept.
Frequently Asked Questions
Why is database security not enough on its own?
Because a database management system only guards the traditional front-door channels, the queries and interfaces users are supposed to go through. The data itself still lives in the computer’s storage resources, both memory and physical media, and those can be reached in other ways. You would never bolt the front door of your home and leave the back door wide open, so the underlying storage needs protection every bit as much as the query interface does.
How do attackers reach storage without going through the front door?
The most basic threat is illegitimate access to storage resources. If administrators fail to set proper file system access controls, an intruder can stumble onto sensitive data just by browsing the file system, and in sensitive settings an attacker may bypass operating system controls to read the physical media directly. The strongest answer is an encrypted file system reachable only through the primary operating system, and multilevel environments must isolate shared memory across classification levels.
What extra danger does cloud storage introduce?
Storage access-control errors turn especially dangerous in the cloud, where a single misconfiguration can expose sensitive data to the entire public internet in an instant. A storage bucket meant to be private can be flipped open with one careless setting, letting anyone browse it. Organizations should set strong default settings that restrict public access from the start, then watch closely for any change that would open that access up.
How can data leak through hidden storage channels?
The second major threat is the covert storage channel attack, which smuggles sensitive data between classification levels by manipulating shared storage media. In its simplest form this means writing secret data to a portion of memory or storage that is inadvertently shared. More sophisticated versions signal information indirectly, such as through the amount of free space on a disk or the size of a file, turning ordinary storage behavior into a secret code between security levels.
📚 Master the ISC2 CISSP Exam!
Ready to test your knowledge? Access chapter-specific Multiple Choice Questions (MCQs) and full-length practice exams for the ISC2 CISSP certification at RooCloud.com. Solve the chapter-wise questions to reinforce this lesson before moving to the next episode.
Reference: This article is based on concepts discussed in CISSP 20.3 - Storage Threats.