What you will learn from this tip: Controlling access to your SAN, using hard zoning and establishing a good key management can keep your data safe. Learn more about these techniques and others in this tip.
Like any other network, SANs are vulnerable to attack. Below are seven precautions you can take to secure high-value information on your SAN.
1. Use a separate network for your SAN
One of the advantages of iSCSI storage is that it can use your LAN, reducing the costs. However, if you're concerned about security, you're better off having a physically separate network for your SAN alone.
2. Use hard zoning
With hard zoning, access to the zone is physically blocked. While hard zoning is not as convenient as soft zoning for subdividing a LAN, it is more secure. ((Content component not found.))
3. Control access to your SAN
This doesn't just mean having the appropriate access controls on users -- it means having the proper security for the SAN itself. Many SAN switches and HBAs have external connections for remote maintenance and troubleshooting. That's handy in the normal course of things, but it opens a gaping security hole. In theory, a black hat could use that maintenance port to get into your switch and compromise your system. Most of the devices that allow remote access also let you turn that feature off.
4. Manage and log changes to your SAN
It's important to secure the management function of your SAN. Unauthorized changes to the configuration, port assignments, ACLs or device lists can leave even the best designed SAN vulnerable. Some companies, such as Brocade, offer SAN operating systems specially designed for security. Most modern SAN management tools have features to prevent unauthorized changes and to securely log any changes that are made.
5. Encrypt your data over the SAN
Whether you are using an iSCSI or Fibre Channel SAN, encrypting sensitive data is an important security measure.
Please note that some encryption programs, such as Microsoft Corp.'s Encrypting File System (EFS), automatically decrypt data before sending it over the network. EFS and similar products are only designed to protect your data while it is stored on disk, not while it is in transit. Products such as Assurency SecureData from Kasten Chase Applied Research Limited encrypt data moving over the SAN.
If you decide to encrypt data make sure you have an effective, secure and tested key management system in place before you begin encryption. An encryption system is only as secure as its keys and an encryption system without a method for recovering lost or damaged keys is an invitation to data loss.
6. Consider physical security
Don't neglect the physical security of the SAN switches or the storage. Server and switch locations should have access control to prevent unauthorized people from gaining access to the equipment.
7. Weigh your risks
The most important principle in any kind of security is weighing the risks against the benefits of proposed security measures. How much security you need depends very much on the value of what you are trying to protect. This kind of cost/benefit analysis is especially important when considering the purchase of equipment such as SAN encryption devices.
Do you know…
About the author: Rick Cook has been writing about mass storage since the days when the term meant an 80 K floppy disk. The computers he learned on used ferrite cores and magnetic drums. For the last 20 years, he has been a freelance writer specializing in storage and other computer issues.
