The following list of key server and USB flash drive characteristics might help you to choose  the type of encryption key provider that you want to use. Important:  Maintaining the confidentiality of the encrypted data hinges on the security of  the encryption keys. Pay special attention to ensure secure creation, management, and  storage of the encryption keys. After the license activation step is successfully completed for all IBM SAN Volume Controller  nodes, you can now enable encryption. You can enable encryption after the completion of the  initial system setup by using either GUI or command-line interface (CLI). There are two ways  in the GUI to start the Enable Encryption wizard:  646  Implementing the IBM System Storage SAN Volume Controller with IBM Spectrum Virtualize V8.2.1 Figure 12-21 Enable Encryption from the  Suggested Tasks  window GLYPH<SM590000> It can be started by clicking  Run Task  next to Enable Encryption on the Suggested Tasks  window, as shown in Figure 12-21. GLYPH<SM590000> Key servers can have the following characteristics: – Physical access to the system is not required to perform a rekey operation. – Support for businesses that have security requirements that preclude use of USB  ports. – Possibility to use ha rdware security modules (HSMs) for encryption key generation. – Ability to replicate keys between se rvers and perform automatic backups. – Implementations follow an o pen standard (Key Management Interoperability Protocol  (KMIP)) that aids in interoperability. – Ability to audit oper ations that are related to key management. – Ability to separately manageencryption keys and physical access to storage systems. GLYPH<SM590000> USB flash drives have the following characteristics: – Physical access to the system might be required to process a rekey operation. – No moving parts with almost no read or write operations to the USB flash drive. – Inexpensive to maintain and use. – Convenient and easy to have multiple identical USB flash drives available as backups. 12.4.1 Starting the Enable Encryption wizard