An organization is implementing a hardware security module (HSM) to manage cryptographic keys. The security architect requires that keys be backed up securely and that the backup process ensures the same level of protection as the primary key storage. Which backup method best meets this requirement?
Trap 1: Export the key in plaintext and store it in a safe
Plaintext export defeats the purpose of an HSM.
Trap 2: Replicate the HSM configuration to another HSM in a different…
Replication is not a backup; it provides high availability, not an independent backup copy.
Trap 3: Store an encrypted copy on a local server in the same data center
Local storage does not protect against site-wide disasters.
- A
Export the key in plaintext and store it in a safe
Why wrong: Plaintext export defeats the purpose of an HSM.
- B
Replicate the HSM configuration to another HSM in a different location
Why wrong: Replication is not a backup; it provides high availability, not an independent backup copy.
- C
Use the HSM's key-wrapping function to encrypt the key and store the wrapped key in a secure offsite facility
Key wrapping maintains the same cryptographic boundary and offsite storage provides redundancy.
- D
Store an encrypted copy on a local server in the same data center
Why wrong: Local storage does not protect against site-wide disasters.