What is a secure key management practice for cryptographic keys?

• A. Store keys in plain text on a local server.
• B. Use a centralized key management system, rotate keys regularly, store keys securely (HSMs), restrict access, and log key usage.
• C. Share keys with all developers for testing.
• D. Never audit key usage to avoid overhead.

Answer: (B)

Protecting cryptographic keys across their life cycle is essential. A centralized key management system with regular key rotation, secure storage in hardware-backed modules (HSMs), strict access controls, and comprehensive logging provides strong protection and accountability. Centralization helps enforce consistent policies, makes it easier to revoke or rotate keys, and ensures keys are generated and used without leaving them exposed in plain form. Hardware security modules protect keys from tampering and unauthorized access, performing cryptographic operations inside a secure boundary so the keys themselves aren’t exposed. Regular rotation limits the window of opportunity if a key is compromised, reducing potential damage. Logging every key use creates an auditable trail that supports detection, investigation, and compliance. In contrast, storing keys in plain text on a local server is highly vulnerable, sharing keys with all developers introduces uncontrolled exposure, and never auditing key usage prevents identifying misuse or breaches.