SAN security under the spotlight

[InfoSec News <isn () c4i org>]

http://www.theregister.co.uk/content/63/27947.html

By Bryan Betts
Posted: 05/11/2002 at 17:06 GMT

Having got standards programmes underway for SAN interoperability and
management, the Storage Networking Industry Association (SNIA) is
turning its attention to the next key part of the puzzle: storage
security.

"Three things kicked it off," says Mike Alverado of Neoscale, who
chairs SNIA's Storage Security Industry Forum
(http://www.snia.org/tech_activities/storage_security), which held a
technology demonstration at Storage Networking World in Orlando this
week.

"First, storage over IP, as IP networks are assumed to be insecure.  
Second, the development of near-line applications means that storage
can now be in an insecure remote location - tapes can be stolen, too.

"The third thing is that storage consolidation on the SAN gives you a
place to where all data is shared, and the business managers don't
like that because they like their data to be private. So IT is
throwing a party and no-one wants to go."

The challenge is that application-level security, network security and
storage-level security must all work together. For example, encryption
of SAN block traffic relies on the application to do authentication.

Alverado says that security has to be integrated within management
frameworks too, so the SNIA storage management initiative (SMI)  
includes fleshing out and refining the security model.

"The concerns are the effect of security on throughput, and the
business value of adding security - it too easily becomes a technical
issue or just insurance," he says. "You cannot view it as insurance,
it has to be built in."

The industry has already voted to adopt the existing CHAP
authentication protocol for Fibre Channel, he adds. The SSIF is also
working on a security protocol analogous to the IETF's IPsec,
provisionally titled FCsec.



-
ISN is currently hosted by Attrition.org

To unsubscribe email majordomo () attrition org with 'unsubscribe isn'
in the BODY of the mail.