An enterprise financial organization is redesigning its Storage Area Network (SAN) security architecture to comply with data-at-rest encryption requirements for bulk database backups. The design must eliminate host server CPU overhead during cryptographic operations and safeguard encryption keys against physical tampering or theft from the data center. Which of the following storage security solutions best meets these requirements?
- Implementation of Self-Encrypting Drives (SEDs) backed by an enterprise Hardware Security Module (HSM) for key managementAnswer
- BDeployment of host-managed asymmetric RSA-4096 file-level encryption at the operating system storage layer
- CConfiguration of inline SAN frame hashing with digital signature verification across network storage switches
- DProvisioning of host-based software firewalls combined with Network Intrusion Detection System (NIDS) rules on SAN switches
Answer
Deploying Self-Encrypting Drives (SEDs) coupled with an enterprise Hardware Security Module (HSM) for cryptographic key management.
Self-Encrypting Drives (SEDs) offload cryptographic processing to dedicated drive hardware, executing symmetric encryption at full bus speed without host OS performance overhead. Utilizing a Hardware Security Module (HSM) ensures secure, centralized management of the key encryption keys within a physical and logical tamper-evident security boundary, satisfying all performance and security architecture requirements.
Step-by-Step Solution
Key Concept
Data Protection at Rest & Storage Key Security (SED and HSM)