A logistics enterprise hosting financial transaction archives on an enterprise Storage Area Network (SAN) must ensure bulk data at rest remains cryptographically protected if physical drives are stolen or improperly decommissioned. The security architecture team mandates that encryption and decryption operations execute directly on the storage controller hardware without host server performance overhead, while key generation and key lifecycle management must remain strictly isolated inside a dedicated FIPS 140-3 validated key management appliance. Which of the following storage security solutions best meets these requirements?
- Deploy Self-Encrypting Drives (SEDs) within the storage array and integrate them with an external Hardware Security Module (HSM) using the Key Management Interoperability Protocol (KMIP).Answer
- BImplement host-based software full disk encryption utilizing RSA-4096 asymmetric encryption managed by the database server operating system.
- CConfigure Fibre Channel LUN masking and network zoning rules on SAN switches combined with SHA-256 hashing of stored array volumes.
- DInstall endpoint Data Loss Prevention (DLP) software drivers directly onto SAN storage array controllers to intercept and block unauthorized block-level write operations.
Answer
Deploying Self-Encrypting Drives (SEDs) integrated with an external Hardware Security Module (HSM) via KMIP is the correct storage security architecture choice.
Combining hardware-based Self-Encrypting Drives (SEDs) with an external Hardware Security Module (HSM) satisfies both performance and key isolation constraints. SEDs perform symmetric encryption directly on the drive controller to eliminate host system overhead, while the HSM acts as a centralized, FIPS-validated appliance for managing root keys via standardized protocols like KMIP.
Step-by-Step Solution
Key Concept
Storage Encryption at Rest and HSM-based Key Management Architecture
Estimated Time:1m 30s