Examkin

Question

Difficulty: MediumData Protection and Storage Security Architecture

A international maritime logistics enterprise operates edge storage appliances at remote port facilities to handle offline container manifest data. The security architecture team must ensure that if storage drives are physically stolen from an unattended facility, the data at rest cannot be extracted. Additionally, key lifecycle management must be centralized without relying on local site administrators to manually unlock storage volumes after a system reboot. Which of the following storage security architectures best meets these requirements?

  1. Self-Encrypting Drives (SEDs) integrated with an enterprise Key Management Interoperability Protocol (KMIP) serverAnswer
  2. B
    Software-based RSA asymmetric bulk encryption applied to all local storage partition blocks
  3. C
    Transport Layer Security (TLS) tunnel encapsulation configured between the edge storage appliances and central servers
  4. D
    Endpoint Data Loss Prevention (DLP) agents restricting file copying to unauthorized USB mass storage devices

Answer

Self-Encrypting Drives (SEDs) integrated with an enterprise Key Management Interoperability Protocol (KMIP) server
Self-Encrypting Drives (SEDs) perform low-level hardware cryptographic operations directly on the drive controller, ensuring that data is completely inaccessible if physical drives are detached or stolen. Connecting SEDs to a centralized Key Management Interoperability Protocol (KMIP) server enables centralized key management and automated, secure authentication during remote appliance booting without requiring local administrator password entry.

Step-by-Step Solution

1
Identify the primary security requirement for physical drive theft.
Protection of data at rest on physical storage media requires full disk or media-level encryption.
If physical drives are stolen from a remote port site, unencrypted media can be read directly on an external controller.
2
Evaluate key management constraints for unattended remote appliances.
Centralized, automated key orchestration is necessary to unlock encryption keys across remote nodes without manual local administrator intervention.
Standardizing key lifecycle management via KMIP allows central Hardware Security Modules (HSMs) or key servers to supply media encryption keys securely over network boot.
3
Select the control architecture that combines hardware-level encryption with automated key management.
Self-Encrypting Drives (SEDs) combined with a central KMIP service satisfy both hardware encryption and centralized key management.
SEDs perform transparent hardware-level cryptographic operations with negligible performance overhead and lock automatically upon loss of power or physical removal.

Key Concept

Data Protection at Rest and Centralized Storage Key Management
Rate this question

Topics

Data Protection and Storage Security Architecture

More questions from this topic