Examkin

Question

Difficulty: HardData Protection and Storage Security Architecture

A financial enterprise is decommissioning a multi-tenant cloud storage array containing sensitive personally identifiable information (PII) stored across encrypted block volumes. The architecture relies on envelope encryption where unique Data Encryption Keys (DEKs) are wrapped by Key Encryption Keys (KEKs) managed inside a Key Management Interoperability Protocol (KMIP)-compliant Hardware Security Module (HSM). The compliance team mandates immediate, verifiable data sanitization before the physical storage media is recycled by the provider, but traditional multi-pass disk overwriting would exceed bandwidth limits and disrupt SAN performance. Which of the following storage security architectural approaches best satisfies these operational and compliance constraints?

  1. Perform cryptographic erasure by zeroizing and securely deleting the wrapping Key Encryption Keys from the central Hardware Security Module.Answer
  2. B
    Re-encrypt the bulk storage volumes using asymmetric 4096-bit RSA public key pairs prior to volume detachment.
  3. C
    Configure restrictive Fibre Channel SAN zoning and LUN masking rules to isolate the targeted storage volumes at the storage network layer.
  4. D
    Deploy inline Data Loss Prevention agents on storage controllers to audit and block external data read requests during decommissioning.

Answer

Perform cryptographic erasure by zeroizing and securely deleting the wrapping Key Encryption Keys from the central Hardware Security Module.
Cryptographic erasure (crypto-shredding) is the process of deliberately deleting or zeroizing the cryptographic keys (specifically the KEKs or DEKs) used to protect encrypted data. In an envelope encryption architecture backed by an HSM, destroying the wrapping Key Encryption Key makes it mathematically impossible to recover the Data Encryption Keys or the block storage ciphertext, satisfying standards such as NIST SP 800-88 without generating heavy disk I/O.

Step-by-Step Solution

1
Analyze operational and compliance requirements for storage media sanitization
Determined that physical overwrite operations (such as NIST 800-88 Clear/Purge via multi-pass zeroing) are unfeasible due to SAN throughput constraints.
Sanitization must be executed instantly at the cryptographic boundary.
2
Evaluate the key hierarchy within the envelope encryption model
DEKs encrypt the raw data blocks, while KEKs protect the DEKs within the HSM. Without access to the KEK, wrapped DEKs cannot be decrypted.
Destroying the root KEK permanently breaks the cryptographic trust chain.
3
Select Cryptographic Erasure (Crypto-Shredding) as the target control
Zeroizing key material in the KMIP HSM renders the data mathematically unrecoverable, fulfilling media sanitization requirements.
Crypto-shredding guarantees sanitization even if the physical media is later repurposed or retained by a third-party cloud provider.

Key Concept

Cryptographic Erasure (Crypto-Shredding) and Key Management Architecture
Rate this question

Topics

Data Protection and Storage Security Architecture

More questions from this topic