An enterprise security team is upgrading its data protection and storage security architecture to protect sensitive databases and block storage volumes across on-premises SAN and cloud environments. The architect needs to implement controls that ensure centralized key governance for encrypted storage, isolate storage network traffic to authorized hosts, and prevent unauthorized exfiltration of sensitive files from endpoints. Which of the following technical controls should the architect implement to meet these storage security requirements? (Select THREE)
- Deploy dedicated Hardware Security Modules (HSMs) to manage master encryption keys and secure volume envelope encryption key hierarchies.Answer
- Configure Storage Area Network (SAN) LUN masking and Fibre Channel zoning to restrict logical unit access strictly to authorized servers.Answer
- Deploy endpoint Data Loss Prevention (DLP) agents to monitor, detect, and block unauthorized copying of sensitive storage data to removable media or cloud shares.Answer
- DImplement asymmetric RSA-4096 algorithms for direct bulk disk block encryption to maximize storage write throughput.
- EApply stateless perimeter router access control lists (ACLs) to remediate memory buffer overflow vulnerabilities in host storage controller software.
Answer
The enterprise must deploy Hardware Security Modules (HSMs) for centralized encryption key governance, configure SAN LUN masking and Fibre Channel zoning for storage access isolation, and implement endpoint Data Loss Prevention (DLP) agents to prevent unauthorized data exfiltration.
Hardware Security Modules (HSMs) safeguard master cryptographic keys used in envelope encryption for storage volumes. SAN LUN masking and Fibre Channel zoning provide network and logical isolation ensuring only authorized servers mount specific storage drives. Endpoint Data Loss Prevention (DLP) inspects file actions and blocks unauthorized data exfiltration.
Step-by-Step Solution
Key Concept
Data Protection and Storage Security Architecture Controls