Security Basics mailing list archives
RE: RAID 5 drive replacement schedule
From: "Burton Strauss" <security () smallnetsolutions com>
Date: Mon, 23 Jun 2008 18:22:02 -0500
Anecdotal but 1st person albeit older... In 1992, XYZ LLP, for whom I worked had cc:Mail servers in about 130 offices. Based on the # of IDE drives, and the then quoted MTBF, we expected about 1 drive per month to fail. And pretty much like clock work, every month we got an email that "a drive in ABC Office had failed and mail sent between x and y needed to be re-sent". (The drives were large, expensive and we had a lot of them so we did not have hardware nor software raid, just backup tapes) In mid-1994, said servers, now being about 3 years old and the drives in them reached the EOL. The # of emails about failures jumped to 4-5 per month. After 3-4 months of this, the IT group ran around replacing drives and the failure rate dropped back below 1/month. -----Burton -----Original Message----- From: listbounce () securityfocus com [mailto:listbounce () securityfocus com] On Behalf Of Murda Mcloud Sent: Sunday, June 22, 2008 3:41 PM To: 'Petter Bruland'; 'Adriel Desautels'; 'Rivest, Philippe' Cc: security-basics () securityfocus com Subject: RE: RAID 5 drive replacement schedule All the usual mechanisms are in place-backups and hot swappable in all our servers etc. What I was interested in was finding out whether there had been any work done to study what the chances of older drives failing was-ie as you get past a certain age-are drives more likely to fail. Anecdotally, I have had the same experience with drives-some fail OOB some just keep spinning. I'm not trying to incur more cost but was wondering whether people ever replace drives in this manner. I thought of the analogy of my mountain bike and how I don't wait for my brakes to fail before I replace them. There are two for a certain kind of redundancy. RAID is obviously different to this though and I would not rely on it solely-hence backups. Now, as I work in a small company, security and 'normal' IT go hand in hand and the boundaries are much fuzzier for me than they are for Adriel. One informs the other. As someone said, money is the choke point and that's the reality.
-----Original Message----- From: listbounce () securityfocus com [mailto:listbounce () securityfocus com] On Behalf Of Petter Bruland Sent: Saturday, June 21, 2008 5:29 AM To: Adriel Desautels; Rivest, Philippe Cc: Murda Mcloud; security-basics () securityfocus com Subject: RE: RAID 5 drive replacement schedule Security or not... Does your array support a hot-spare or stand-by disk? Then that would be the best way to go. Once a drive fails, it will alert based on syslog/eventlog/3rd party app etc that a drive is bad, and rebuild the bad drive's data on the hot-spare/stand-by disk. If that isn't an option, and you are expecting a failure any day, I'd just keep an eye on the array health and make sure you have one or two spare drives on hand. ** I've never done this, but I believe you can slowly replace all drives, and then have a working full RAID-5 disk set as a backup? I have had bad luck with older drives that used to be 24/7, then taken offline and back online. Those are my 2 cents.... And in today's exchange rate, that's not much. -Petter -----Original Message----- From: listbounce () securityfocus com [mailto:listbounce () securityfocus com] On Behalf Of Adriel Desautels Sent: Friday, June 20, 2008 11:00 AM To: Rivest, Philippe Cc: Murda Mcloud; security-basics () securityfocus com Subject: Re: RAID 5 drive replacement schedule Philippe, I disagree with you and I think that the definition of security that you provided is partial, but thats just my opinion. Availability is a vague term that can, but does not always have a role in security. Determining what the proper schedule is for a drive replacement policy is something that can be done by IT without the security team. Deciding how to dispose of the drives on the other hand is security. Regards, Adriel T. Desautels Chief Technology Officer Netragard, LLC. Office : 617-934-0269 Mobile : 617-633-3821 http://www.linkedin.com/pub/1/118/a45 Join the Netragard, LLC. Linked In Group: http://www.linkedin.com/e/gis/48683/0B98E1705142 --------------------------------------------------------------- Netragard, LLC - http://www.netragard.com - "We make IT Safe" Penetration Testing, Vulnerability Assessments, Website Security Netragard Whitepaper Downloads: ------------------------------- Choosing the right provider : http://tinyurl.com/2ahk3j Three Things you must know : http://tinyurl.com/26pjsn Rivest, Philippe wrote:Adriel & Murda It is a security issue the way you store your data. In regards to the raid technologies, raid 5 improves the availability of the data by making sure that a single drive failed will not impact the availabilityof the data.Remember that security is 1- Confidentiality 2- Availability 3- Integrity The main goal of a Raid 5 is to help #2. You are referring to the disposal of the HD which is the issue of confidentiality and that is not what Murda was aiming at. If it is, go for encryption, degaussing, destruction and just plain format (if the data is not confidential). As I explained to him offline, the MTTF and MTBF is about the same for 2 HD bought/constructed at about the same time. How ever, those are not absolute numbers that state that, if one drive fails the other oneis about to go too.It's more an estimated value against which you should have some confidence/hope, your drive should not fail before X hours (it could go before but the average is X). In a raid 5, Drive A, B and C are online and working (they are the same drive bought at the same time). Drive A fails, you should NOT change drive B & C unless they are failing also. If you do, the cost of your raid 5 will be greater then what it should be (the replacing of the parts are going to cost a lot). Change drive A and hope drives B& C will last longer.The only issue is that 2 drives fail at the same time, which is very improbable. And if it does, you should be going for your back ups. I do hope this clarified the questions and that I wasn't to unclear with my details! Merci / Thanks Philippe Rivest, CEH Vérificateur interne en sécurité de l'information Courriel: Privest () transforce ca Téléphone: (514) 331-4417 www.transforce.ca -----Message d'origine----- De : listbounce () securityfocus com [mailto:listbounce () securityfocus com] De la part de Adriel Desautels Envoyé : 20 juin 2008 11:27 À : Murda Mcloud Cc : security-basics () securityfocus com Objet : Re: RAID 5 drive replacement schedule Murda, The real answer to your question is that it is very, veryimprobablethat all of the drives in the array will fail at the same time. Most drives are good for a certain period of years, after which point you are getting "extra time". That is not a security issue though. That is an IT related issue.Thesecurity issue comes into play when you dispose of your drives. Do you shred them, just throw them in the dumpster, how do you dispose ofthem?Regards, Adriel T. Desautels Chief Technology Officer Netragard, LLC. Office : 617-934-0269 Mobile : 617-633-3821 http://www.linkedin.com/pub/1/118/a45 Join the Netragard, LLC. Linked In Group: http://www.linkedin.com/e/gis/48683/0B98E1705142 --------------------------------------------------------------- Netragard, LLC - http://www.netragard.com - "We make IT Safe" Penetration Testing, Vulnerability Assessments, Website Security Netragard Whitepaper Downloads: ------------------------------- Choosing the right provider : http://tinyurl.com/2ahk3j Three Things you must know : http://tinyurl.com/26pjsn Murda Mcloud wrote:In my mind, this a security related question as it has to do with ensuring availability. Does anyone have links towards any whitepapers etc that suggest replacement of disks in a RAID 5 array as part of a maintenance cycle? If all the drives in an array are the same age and one fails; does thismeanthe others are more likely to fail. I'd imagine so as they have had thesameamount of usage.
Current thread:
- Re: Was Re: RAID 5 drive replacement schedule - Now "Availability", (continued)
- Re: Was Re: RAID 5 drive replacement schedule - Now "Availability" Mike Hale (Jun 23)
- RE: Was Re: RAID 5 drive replacement schedule - Now "Availability" Murda Mcloud (Jun 24)
- Re: Was Re: RAID 5 drive replacement schedule - Now "Availability" Adriel Desautels (Jun 23)
- Re: Was Re: RAID 5 drive replacement schedule - Now "Availability" Mike Hale (Jun 23)
- Re: Was Re: RAID 5 drive replacement schedule - Now "Availability" Adriel Desautels (Jun 23)
- Message not available
- Re: Was Re: RAID 5 drive replacement schedule - Now "Availability" Adriel Desautels (Jun 23)
- RE: Was Re: RAID 5 drive replacement schedule - Now "Availability" Nick Vaernhoej (Jun 23)
- RE: Was Re: RAID 5 drive replacement schedule - Now "Availability" Steve Fox (Jun 26)
- RE: RAID 5 drive replacement schedule Petter Bruland (Jun 20)
- RE: RAID 5 drive replacement schedule Murda Mcloud (Jun 23)
- RE: RAID 5 drive replacement schedule Burton Strauss (Jun 24)
- RE: RAID 5 drive replacement schedule Rivest, Philippe (Jun 20)
- Re: RAID 5 drive replacement schedule Adriel Desautels (Jun 20)
- RE: RAID 5 drive replacement schedule Murda Mcloud (Jun 23)
- Re: RAID 5 drive replacement schedule Adriel Desautels (Jun 24)
- Re: RAID 5 drive replacement schedule Mellow Marquis (Jun 25)
- RE: RAID 5 drive replacement schedule Rivest, Philippe (Jun 25)
- RE: RAID 5 drive replacement schedule Nick Vaernhoej (Jun 20)
- Re: RAID 5 drive replacement schedule Adriel Desautels (Jun 20)
- RE: RAID 5 drive replacement schedule Rivest, Philippe (Jun 25)
- RE: RAID 5 drive replacement schedule Nick Vaernhoej (Jun 25)