Match each storage security technology on the left with its corresponding enterprise functional mechanism on the right.
- Envelope Encryption ArchitectureEncrypts plaintext data using a local Data Encryption Key (DEK) wrapped by a Key Encryption Key (KEK).
- SAN LUN MaskingRestricts logical storage volume access to specific host HBA WWNs at the storage array controller level.
- Database Field TokenizationReplaces sensitive data fields with non-sensitive surrogate tokens mapped inside an isolated secure vault.
- Self-Encrypting Drive (SED)Provides transparent hardware-level full disk encryption with native cryptographic erase capabilities.
Answer
Envelope Encryption Architecture pairs with DEK/KEK key hierarchy; SAN LUN Masking pairs with host HBA WWN array restriction; Database Field Tokenization pairs with vault-mapped surrogate replacement; Self-Encrypting Drive (SED) pairs with hardware disk encryption and cryptographic erase.
Each storage security architecture component directly addresses a distinct operational requirement across key management, storage network isolation, application data transformation, and physical drive security: Envelope Encryption manages hierarchical DEK/KEK keys; SAN LUN Masking restricts host access by WWN at the storage controller; Tokenization replaces sensitive fields with vault-mapped surrogates; and SEDs provide hardware media encryption.
Step-by-Step Solution
Key Concept
Data Protection and Storage Security Architecture Controls