Soru

Zorluk: OrtaData Protection and Storage Security Architecture

An enterprise financial institution is designing a storage architecture for high-throughput transaction databases hosted on a Storage Area Network (SAN). Security requirements specify that bulk data at rest must be encrypted at the drive hardware level to eliminate host CPU performance degradation, and all storage keys must be centrally managed using a standardized network protocol integrated with a Hardware Security Module (HSM). Which of the following storage security solutions best meets these requirements?

  1. Self-Encrypting Drives (SEDs) managed via Key Management Interoperability Protocol (KMIP) connected to an enterprise HSMCevap
  2. B
    Host-based software Full Disk Encryption (FDE) utilizing local Trusted Platform Modules (TPMs) for volume key storage
  3. C
    Bulk volume encryption using asymmetric RSA-4096 keys generated natively on host operating systems
  4. D
    Inline network Data Loss Prevention (DLP) appliances positioned between host bus adapters and SAN fabric switches

Cevap

Self-Encrypting Drives (SEDs) managed via Key Management Interoperability Protocol (KMIP) connected to an enterprise HSM
Self-Encrypting Drives (SEDs) utilize dedicated, on-board cryptoprocessors to encrypt and decrypt data at wire speed without burdening host system CPU cycles. Using the Key Management Interoperability Protocol (KMIP) enables seamless integration between storage hardware controllers and a dedicated enterprise Hardware Security Module (HSM) for automated key lifecycle management.

Adım Adım Çözüm

1
Analyze the hardware encryption performance requirement.
Identified that performing bulk encryption directly on drive hardware (Self-Encrypting Drives) offloads cryptographic processing from host CPUs.
Software-based host encryption introduces processing latency and CPU overhead on database host servers.
2
Evaluate key management and protocol standards.
Determined that Key Management Interoperability Protocol (KMIP) provides the standardized interface required to communicate between storage controllers and a centralized Hardware Security Module (HSM).
KMIP normalizes key lifecycle management across heterogeneous enterprise storage arrays and key vaults.

Anahtar Kavram

Hardware-based storage encryption with centralized key management protocols
Tahmini Süre:1m 30s
Bu soruyu puanla