Exam CCSK topic 1 question 146 discussion

E. Isolation failure When a customer's information and/or processes are compromised by the actions of another customer in a multi-tenancy environment, it is referred to as an isolation failure. Isolation failure occurs when the mechanisms that are meant to keep the resources and data of different customers isolated from each other are breached, leading to unauthorized access or interference between tenants' data or applications. The other options (A, B, C, D) do not specifically describe this scenario of a security breach due to the actions of another customer in a multi-tenancy environment.

ENISAPg. 9: ISOLATION FAILURE: multi-tenancy and shared resources are defining characteristics of cloud computing. This risk category covers the failure of mechanisms separating storage, memory, routing and even reputation between different tenants (e.g., so-called guest-hopping attacks). However it should be considered that attacks on resource isolation mechanisms (e.g.,. against hypervisors) are still less numerous and much more difficult for an attacker to put in practice compared to attacks on traditional OSs.

It should be A: CCSK Study Guide pg 143; Data leakage. As with any cloud computing service or product, there is always the concern of data from one cloud user leaking to another. This risk isn’t unique to SecaaS, but the highly sensitive nature of security data (and other regulated data potentially exposed in security scanning or incidents) does mean that SecaaS providers should be held to the highest standards of multitenant isolation and segregation.