I was wondering if SEDs are used in cloud environments, for example in data centers of CSPs like Azure or AWS?
And if so, what additional protection do they offer beside from physical theft of the drive?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
I haven't been able to find information on the specific providers you named, but you may be interested in these two articles.
In terms of security benefits, the encryption key is stored on the disk as opposed to the OS, which makes it harder to extract. By erasing the encryption key, they you can render the data practically irrecoverable, allowing you to securely dispose of an SSD in a relatively convenient manner. Plus, it is a lot quicker and cheaper to wipe in this way than pretty much any other safe method.
Not that they're a magic bullet to all problems. The second article I linked details how, with physical access, a powered-on SED is still vulnerable to some of the same attacks as software-encryption, and potentially other methods as well.
Finally, not a security point, but SEDs have dedicated crypto processors, meaning the data encryption and decryption functions aren't vying for CPU usage, so you do see some performance related benefits from that.