Storage Area Network Information Center

The data managed in your Storage Area Network (SAN) is highly sensitive and must be controlled to properly ensure confidentiality, integrity, and availability. This is no different than other IT infrastructures. In fact, you can simply augment your current corporate security policy to include SAN-specific security items.

POTENTIAL SECURITY THREATS

There are different ways, both intentional and accidental, in which SAN integrity can be compromised. Some potential threats to SANs include:

• Changes to zoning information allowing access to storage and read/write to data
• Changes to security and access control policies allowing unauthorized servers or switches to gain access to SAN
• Exposed network administration passwords allowing unintended individuals to access SAN in role of administrator

• Denial of Service (DOS) attacks
• Using a compromised dual-homed host with a Host Bus Adapter (HBA) to read, store, or distribute SAN files

PROACTIVE SECURITY MEASURES

• Zoning
• Secure fabric operating system

Zoning is a highly recommended feature offered by some, but not all, switch vendors. It allows you to automatically or dynamically arrange fabric-connected devices into logical groups (zones) across the physical configuration of the fabric. These zones can include selected storage, servers, and workstations within a fabric. Information access is restricted to only the "member" devices in the defined zone. Although zone members can access only other members in their zones, individual devices can be members of more than one zone. This approach enables the secure sharing of your storage resources, a primary benefit of storage networks. In addition to improving security, zoning can also help you simplify management of heterogeneous fabrics, maximize storage resources, and segregate storage traffic.

A secure fabric operating system is a complementary feature to zoning and is offered by only some switch vendors. Secure fabric operating systems run on SAN infrastructures, and offer policy-based security. These policies allow you to customize security uniquely to your needs. Secure fabric operating systems help block unauthorized fabric-wide management changes and fabric setting changes, help control server-to-fabric connections, prevent users from arbitrarily adding switches to a fabric, and protect communication between switches and management consoles.

Previous: Troubleshoot and Fix Problems
Next: Upgrade and Expand Your SAN