A financial services organization is designing a high-throughput database storage system that requires transparent, hardware-level data encryption at rest without burdening the host database server CPUs. Additionally, organizational compliance mandates that encryption keys must be generated and lifecycle-managed by a centralized external key appliance. Which of the following storage security solutions best fulfills these requirements?
- Self-Encrypting Drives (SEDs) integrated with a centralized key manager using Key Management Interoperability Protocol (KMIP)Cevap
- BApplication-level asymmetric RSA encryption applied to bulk database tables before writing data to storage
- CInline network firewalls enforcing deep-packet inspection and TLS decryption across storage area network switches
- DSIEM event correlation rules configured to trigger real-time dynamic data masking during database queries
Cevap
Deploying Self-Encrypting Drives (SEDs) integrated with a Key Management Interoperability Protocol (KMIP) server
Self-Encrypting Drives (SEDs) perform full disk bulk encryption at the drive controller hardware layer using fast symmetric ciphers (such as AES), which prevents host CPU overhead. Leveraging the Key Management Interoperability Protocol (KMIP) allows the drive hardware to offload key generation, rotation, and escrow to a centralized enterprise key management appliance.
Adım Adım Çözüm
Anahtar Kavram
Hardware-based Storage Encryption & Centralized Key Management