Which of the following describes a secure key management practice?

• A. Use a centralized key management system with HSMs, rotate keys regularly, store keys securely, restrict access, and log usage.
• B. Store keys in plain text on a local machine.
• C. Share keys broadly with all staff to reduce overhead.
• D. Rotate keys only when a breach occurs.

Answer: (A)

Key management practices for cryptographic material are about controlling how keys are created, stored, used, rotated, and audited. The best approach is to rely on a centralized key management system that uses hardware security modules (HSMs) to protect keys and perform cryptographic operations. This setup provides a secure, tamper-resistant place to store keys and ensures that keys aren’t exposed in software or on individual devices.

Regular key rotation is essential because it limits the amount of data that could be encrypted with a compromised key. If a key is ever exposed, having used multiple keys over time reduces the potential impact. Storing keys securely and restricting access minimizes the chance of unauthorized use, while detailed logging creates an auditable record of who accessed which keys and when, helping detect misuse and support accountability.

In contrast, keeping keys in plain text on a local machine is inherently insecure, as anyone with access could read them. Sharing keys broadly with all staff violates the principle of least privilege and dramatically increases the risk of exposure. Rotating keys only after a breach is too late and leaves systems vulnerable in the meantime.

This combination of centralized management, hardware-backed protection, proactive rotation, strict access controls, and comprehensive logging embodies robust key lifecycle security.