To secure vSAN storage against unauthorized access for both data on disk and in flight, administrators must enable vSAN Data-at-Rest Encryption and vSAN Data-in-Transit Encryption at the cluster level. Data-at-rest encryption protects data stored on the physical drives using a Key Management Server or a vSphere Native Key Provider (which is already configured in this scenario). Data-in-transit encryption secures data moving across the vSAN backend network between hosts. Both settings are centrally managed within the vSphere Client under the cluster's vSAN Services configuration tab. Enabling these natively secures the VxRail environment without requiring self-encrypting drives (SEDs).

VMware. (2021). vSphere 7.0 Update 3: Administering VMware vSAN. Section: "Using Encryption in a vSAN Cluster", pp. 112-115. Official VMware Documentation.

Dell Technologies. (2022). Dell VxRail Appliance: Administration Guide for vSphere 7.0. Section: "Securing VxRail Storage with vSAN Encryption", pp. 88-90. Official Dell Documentation.

VMware. (2021). vSphere Security Guide 7.0. Section: "vSphere Native Key Provider Overview", pp. 45-48. Official VMware Documentation.