Tip

Storage security policies created through hacking

VARs can often find the weaknesses in a customer's storage security by testing the system that is in place. By hacking into a customer's system, VARs can find the backdoors and loopholes that someone mounting a malicious attack can use as an entry way to critical data. Do these vulnerable points exist because of poor security management? Can they be fixed by implementing more effective storage security practices? Kevin Beaver offers his technical advice on why it is necessary for VARs to establish security protocols.

    Requires Free Membership to View

Hack your storage to test your security

When it comes to testing for vulnerabilities in storage systems (DAS, NAS, and SANs), it's easy to overlook weaknesses that may be obvious to a malicious insider or other attacker. From perimeter security weaknesses to insider advantages, such as knowing just where sensitive storage devices are located, these kinds of hit-or-miss issues will get you every time.

More on storage security:
Data-in-transit security and tracking services

Integration demands drive storage security offerings

Any storage system that supports typical network protocols and file systems (HTTP, FTP, CIFS, NFS, etc.) will also inherit any vulnerabilities associated with those protocols; likewise for operating system configuration weaknesses, software exploits, password problems, Web applications and more. At a minimum, you should perform the following security tests (a.k.a. ethical hacks) on your storage system to find holes and fix them before someone exploits them. Keep in mind that certain tests will vary (or not apply) depending upon the type of storage system you have and its underlying operating system (OS), as well as the type of network and/or physical access obtained.

  1. Scan the system to discover open ports, listening services, banner pages, missing patches, Web application and/or database concerns and exploitable weaknesses.
  2. Enumerate the system to find available shares, exports, users, security policies and more.
  3. Sniff network traffic to discover clear-text usernames and passwords that can be used to further penetrate storage devices. For SAN environments, Fibre Channel, switch and management information can be discovered in clear-text traffic.

Read the rest of Beaver's article at SearchStorage.com

Effective storage security policies

There are a lot of sample information security policies floating around the Internet. If you know which policies you need, you can even purchase policy templates if you're willing to spend the money. So, what does it mean and what does it take to have a practical set of storage security policies that can work for you in the real world?The bottom line is that you've got to know which risks are present in your storage systems and which ones would have the greatest impact and likelihood of occurrence before you can implement the appropriate policies and supporting controls.

In order to stay organized and keep things simple, you'll need to have a standard security policy template. This will make policy creation and maintenance so much simpler in the long-term than simply bundling everything into one large and unorganized document.

Now it's time to create your actual policies. Remember -- create policies based on risks discovered and business needs. However, the following policies should be on your radar as they all relate to storage security in one way or another:

  1. Access controls -- admin rights, file/share permissions, cryptographic controls, zoning configurations, etc.
  2. Change management -- why, when, who, testing requirements, backout procedures, etc.
  3. System monitoring and incident response -- real-time monitoring, audit logs, incident response plan requirements, etc.
  4. User authorization -- granting access -- who, what, when, how long, etc.

Read the rest of Beaver's article at SearchStorage.com

About the author: Kevin Beaver is an independent information security consultant, author and speaker with Atlanta-based Principle Logic, LLC. He has more than 18 years of experience in IT and specializes in performing information security assessments. Kevin has written five books including Hacking For Dummies (Wiley), Hacking Wireless Networks For Dummies, and The Practical Guide to HIPAA Privacy and Security Compliance (Auerbach). He can be reached at kbeaver @ principlelogic.com.

This was first published in March 2007

There are Comments. Add yours.

 
TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

Disclaimer: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.