---
title: >-
  Crown jewel GCS bucket is vulnerable to ransomware or deletion via internal
  access
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Crown jewel GCS bucket is vulnerable to
  ransomware or deletion via internal access
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Crown jewel GCS bucket is vulnerable to ransomware or deletion via internal access

## Description{% #description %}

A Google Cloud Storage bucket tagged as a crown jewel asset is exposed to ransomware or destructive attacks through internal access — an attacker who compromises an internal identity with delete or overwrite permissions could permanently destroy or encrypt the bucket's contents without the ability to recover previous versions. Because the bucket is a crown jewel, the impact of data loss or a ransom event is significantly higher than for a typical bucket.

## Remediation{% #remediation %}

1. Enable [object versioning](https://cloud.google.com/storage/docs/object-versioning) to retain previous versions of objects and allow recovery from malicious or accidental deletion/overwrite.
1. Configure a [retention policy](https://cloud.google.com/storage/docs/bucket-lock) on the bucket to prevent objects from being deleted or overwritten before a specified duration.