Other Hardware Options
Why Drive-Based Encryption Is Safest and Best
What's this
Aside from drive-based encryption, data-at-rest encryption (as opposed to on-the-fly encryption, as in secure online communications) has three other options: host-based, fabric-based, and controller-based.
Host-based encryption—meaning software encryption computed by the host, as mentioned with TrueCrypt—is commonly used as a complementary approach alongside SEDs. The advantage of host-based encryption is that it encrypts data at its point of creation, not out at the far end of the data chain (within the drive). Between creation and the drive, it’s possible for various software attacks to intercede and steal information. Again, having hardware-based acceleration, such as AES-NI, makes host-based encryption far more cost-effective and efficient.
Host-based encryption allows drive authentication to happen even earlier in the boot process than happens with BIOS authentication. Software solutions from companies such as CryptoMill, Wave Systems, and WinMagic deliver authentication credentials to the drive controller so that the drive will unlock and decrypt data as it emerges from the controller.
Another added advantage of these third-party packages is that they allow for key management and provisioning across a company. One administrator working through a console can potentially manage the drive locking, password recovery, key distribution, and more for thousands of systems.
Fabric-based encryption is a legacy approach now generally viewed to be in decline. Fabric-based encryption uses a host adapter plus an appliance, often in the form of a switch, that sits between the host and the storage array. The advantage for admins is that fabric-based encryption allows for granular access policies and key management. The downside is that periodic re-keying is advisable, which entails more management expense, and there can be compatibility issues between fabric encryption components and host storage adapters.

Controller-based encryption is a relatively new and still not widely deployed alternative that resembles host-based encryption, only encryption is performed by a crypto ASIC located on a host bust adapter (HBA). However, because key management is handled outside of the controller, this adds an additional layer of cost and complexity. Moreover, because the HBA is the bottleneck for data flow, more attention to workload balancing may be needed.
On the other hand, a key advantage for controller-based encryption is that it offers a way to protect existing non-SED storage without incurring either the potential headaches of cryptographic computing or the expense of drive replacement.