Question

A financial services company is deploying a new payment processing platform that must generate and store the master encryption keys used to protect cardholder data. Regulators require that the private keys never exist in plaintext outside a tamper-resistant boundary, and that key operations be auditable. Which control best satisfies these requirements?

Accepted Answer

Generate and store the keys within a FIPS 140-2 Level 3 hardware security module (HSM)

Answer

Store the keys in an encrypted database column protected by the application's service account credentials

Answer

Use a software-based key vault running on a hardened virtual machine with full-disk encryption

Answer

Distribute the keys across multiple application servers using Shamir's Secret Sharing at the OS level