Encryption Keys in the Wrong Hands
A healthcare analytics company stores patient records in object storage and runs queries from a managed data warehouse. The security team enabled default encryption at rest using provider-managed keys, and access is controlled by IAM roles scoped per team. During an audit, an engineer discovers that a contractor's role can read the entire bucket because it was attached to a broad "analyst" policy inherited from a pilot project. Logs show the contractor's credentials were used from two countries within the same hour last month. The company must report confirmed unauthorized access to protected health information within 60 days and is weighing three options: rotate the storage keys immediately, remove the contractor role and re-scope the policy, or migrate all data to a new bucket with customer-managed keys.
1. Which response addresses the confirmed exposure most directly, and how would you sequence the three options?
Read the worked answer
The exposure is an authorization failure, not a key-compromise failure: the contractor could read data because of an over-broad IAM policy, so removing the role and re-scoping the policy is the direct containment step and should come first. Rotating provider-managed storage keys does little here because the access path was legitimate credentials under an overly broad policy, not stolen key material; rotation only helps if keys themselves leaked. Migrating to a new bucket with customer-managed keys is a defensible longer-term control for data isolation and auditability, but it is slow and does not close the current access path. Sequence: (1) revoke the contractor role and any sessions, (2) re-scope the analyst policy to least privilege and audit other roles for the same inheritance, (3) preserve logs for the incident report, then (4) evaluate customer-managed keys and bucket-level segmentation as a follow-on hardening project. The 60-day reporting clock makes containment and evidence preservation urgent; migration should not delay them.
2. What does the two-country log evidence change about your obligations and investigation?
Read the worked answer
Concurrent use from two countries within an hour is a strong indicator of credential misuse or sharing, which upgrades the event from a policy-hygiene finding to a suspected security incident involving protected health information. That triggers the breach-assessment and notification process rather than a quiet policy fix. The investigation should determine which objects the role actually accessed, whether data was downloaded versus listed, and whether the two locations are consistent with the contractor's known travel or VPN. Preserve access logs and identity logs before rotating or deleting anything, since deletion of the role can complicate attribution if logs are incomplete. The notification decision depends on whether the access constituted unauthorized acquisition; document the analysis either way, because the regulator will ask what was accessed and when the company knew.