Examkin

Question

Difficulty: Very hardData Protection and Storage Security Architecture

An enterprise financial network is deploying a high-throughput NVMe Storage Area Network (SAN) array to process ultra-low latency trading transactions containing sensitive data. The lead security architect must ensure all data at rest is cryptographically protected against physical drive theft or unauthorized removal from the data center without degrading storage controller IOPS performance. Furthermore, drive decommissioning must support instant cryptographic erasure without requiring manual degaussing or physical drive shredding, while root keys must be bound to a centralized enterprise key management architecture over Key Management Interoperability Protocol (KMIP). Which architectural design strategy best satisfies all of these operational and cryptographic requirements?

  1. Deploy hardware-based Self-Encrypting Drives (SEDs) utilizing symmetric AES Media Encryption Keys (MEKs) generated on-drive, wrapped by Key Encryption Keys (KEKs) managed centrally by an enterprise Hardware Security Module (HSM) over KMIP.Answer
  2. B
    Configure host-side operating system software encryption using asymmetric RSA-4096 key pairs generated directly inside a centralized HSM for all bulk disk block write operations across SAN storage volumes.
  3. C
    Implement inline storage switch network firewalls and Deep Packet Inspection (DPI) intrusion prevention controls across the Fibre Channel SAN fabric switches.
  4. D
    Apply host-based HMAC-SHA256 digital hashing across all SAN block storage LUN writes to prevent physical drive theft and fulfill automated drive retirement sanitization mandates.

Answer

Deploy hardware-based Self-Encrypting Drives (SEDs) utilizing symmetric AES Media Encryption Keys (MEKs) generated on-drive, wrapped by Key Encryption Keys (KEKs) managed centrally by an enterprise Hardware Security Module (HSM) over KMIP.
Self-Encrypting Drives (SEDs) perform bulk data-at-rest encryption inside dedicated drive controller ASICs using symmetric AES keys (MEKs). By integrating with a centralized Hardware Security Module (HSM) via KMIP to manage Key Encryption Keys (KEKs), the organization achieves offloaded hardware-rate performance, centralized key lifecycle control, and instant cryptographic erasure upon drive retirement through KEK revocation.

Step-by-Step Solution

1
Evaluate storage performance and data confidentiality requirements
Bulk encryption must be executed at hardware wire-speed (on-drive encryption/SEDs using symmetric ciphers like AES) to avoid latency overhead on host CPUs and storage controllers.
Host-based software encryption or asymmetric ciphers add substantial computational overhead incompatible with ultra-low latency NVMe SAN trading platforms.
2
Evaluate key management and sanitization/decommissioning requirements
Cryptographic erasure (crypto-shredding) is achieved by revoking or zeroizing the Key Encryption Key (KEK) or Media Encryption Key (MEK).
When the KEK managed in the central HSM is destroyed or access revoked via KMIP, data on the drive instantly becomes unrecoverable plaintext, fulfilling zeroization mandates without physical destruction.
3
Synthesize key management integration
Centralizing KEK governance within a Hardware Security Module (HSM) using KMIP integrates enterprise key management with localized SED hardware encryption.
This establishes a robust root of trust while enforcing separation of duties between storage hardware and key storage.

Key Concept

Storage Security Architecture, SEDs, HSM Key Hierarchy, and Cryptographic Erasure
Rate this question

Topics

Data Protection and Storage Security Architecture

More questions from this topic