Where should encryption keys be stored for best security?

Where should encryption keys be stored for best security?

• A. On the same system as data.
• B. In a secure vault or HSM, separate from data.
• C. On user laptops.
• D. In plaintext in configuration files.

Answer: (B)

Key material must be protected separately from the data it protects. Storing encryption keys in a secure vault or hardware security module (HSM) provides a physically secure, tamper-resistant environment with strong access controls and centralized key management. The HSM can perform cryptographic operations without exposing the actual keys to the host system, which reduces the risk if the system is compromised and supports key rotation and auditing. If keys live on the same system as the data, on user laptops, or in plaintext configuration files, a breach that reaches that system can expose both the data and the keys, making it easy to decrypt the information. Keeping keys in a secure vault or HSM, separate from the data they protect, is the best practice for secure key management and protects against many common attack paths.

Key material must be protected separately from the data it protects. Storing encryption keys in a secure vault or hardware security module (HSM) provides a physically secure, tamper-resistant environment with strong access controls and centralized key management. The HSM can perform cryptographic operations without exposing the actual keys to the host system, which reduces the risk if the system is compromised and supports key rotation and auditing.

If keys live on the same system as the data, on user laptops, or in plaintext configuration files, a breach that reaches that system can expose both the data and the keys, making it easy to decrypt the information. Keeping keys in a secure vault or HSM, separate from the data they protect, is the best practice for secure key management and protects against many common attack paths.