What is the primary objective of cryptographic key management and lifecycle practices?

• A. Keys should be encrypted at rest but not rotated.
• B. Keys should be rotated only annually.
• C. Keys should be generated securely, stored in HSM/KMS, rotated regularly, and revoked if compromised; maintain access controls and audits.
• D. Keys should be kept on developer laptops.

Answer: (C)

Key management and lifecycle practices focus on protecting cryptographic keys throughout their entire life, from creation to retirement. The strongest approach is to generate keys securely (ideally inside a hardware-backed environment like an HSM or a trusted KMS), store and protect the key material in a secure, centralized store, rotate keys regularly to limit the impact of any single key being compromised, revoke keys promptly if a compromise is detected, and maintain strict access controls along with thorough audit logging. This combination reduces the risk of key exposure, contains the blast radius if a key is compromised, and supports compliance by making key usage traceable.

Storing keys on developer laptops or around the clock without rotation leaves them vulnerable to theft or leakage, and relying on encryption at rest alone does not address how keys are created, stored, used, or revoked. Annual rotation can be too infrequent to mitigate modern risk, and without secure generation, storage, and access controls, the protection provided by encryption is undermined.