• United States



by Jamie Gruener

The Emerging Storage Security Challenge

Oct 17, 20033 mins
CSO and CISOData and Information Security

Network storage has changed the way enterprises manage their storage environments. It is crucial to safeguard data, regardless of whether it is retained at-rest inside storage systems, or in-flight across the storage network, LAN, or WAN. However, the significant complexity of deploying and managing storage networks makes security a fragile proposition. Gone are the days of the storage network as a closed network. In fact, the storage network is going through the same evolution traditional enterprise networks went through 5 years ago, when intrusions and denial of service (DoS) attacks were commonplace. Today, customers must consider security not only for the SAN, but also for business continuity, remote backup and tape operations, consolidation projects, and managed services.

Like enterprise networks, enterprises need to put security policies in place that meet requirements for specific business-critical applications, disaster recovery, and data protection. The stakes are high. Compliance with a growing number of government regulations relies on the enterprise’s ability to safeguard data, regardless of where it is. This report examines the key security threats enterprises need to consider regarding storage, the top tactics to secure the storage network, which vendors currently offer products, and best practices in selecting products. Customers must start by evaluating where in the storage security stack they face the greatest threat.

Enterprises will increasingly need to consider storage security in the design of storage networks, management strategies, and storage consolidation. Government mandates also will drive better security requirements. Customers should evaluate which applications and data sets need more advanced security, and ensure proper safeguards are in place to protect data.

The convergence of IP and Fibre Channel networks, the increasing use of remote sites for backup and disaster recovery, and the mounting volume of storage network deployments will accelerate the need for better storage security. New storage security frameworks will include components that range from management software through the foundation network and storage array.

Enterprise Recommendations

  • Start evaluations of storage security solutions immediately. It will take six months to evaluate products while analyzing the enterprise’s unique solution requirements.
  • Make a decision to buy no sooner than six months from now. Security storage products are still in their first-version release and have not been field-tested. Most enterprises would be best served by waiting for the next version before buying.
  • Choose security storage vendors that integrate with the directory strategy. This is not a standalone solution, so do not purchase it as such.
  • Require storage security vendors to provide integration services as part of the purchase. Vendors may not know your environment and unique requirements, and you have very limited or no experience with their platforms.