What you will learn from this tip: Firewalls are often relied upon too much for network security -- especially when it comes to locking down the storage environment. Learn how this firewall demilitarized zone (DMZ) security misconception unnecessarily exposes many critical storage systems and how you can avoid this problem.
There's a misconception going around in storage circles that as long as storage area network (SAN) and network attached storage (NAS) systems are behind a firewall then everything's protected. This simply isn't true. Like most firewall misunderstandings, relying on this type of protection is dangerous at best and isn't a good long-term solution to keep your storage systems safe and sound. Let me explain.
Most storage environments span across multiple networks. Both private and public network segments are often served simultaneously. Be it external Web servers in the DMZ, internal file servers on the internal LAN -- you name it. Serving up multiple network segments creates a virtual bridge effectively negating any network segmentation and firewall. With this configuration, any vulnerable system can be used as a conduit into the storage environment. This happens when a system, such as a Web server, database server or file server on one network segment, is attacked and a conduit of sorts is created via the storage back end to adjacent network segments, essentially bypassing any firewall protection. This may include:
An email server missing a patch, easily exploitable via one of the numerous hacking tools, such as Metasploit, provides the attacker a command prompt and direct access to the attached storage systems or even other internal network systems.
A storage management server that happens to be running Windows Terminal Services that can be easily brute-force attacked using a tool, such as TSGrinder, provides direct access into the storage environment.
A software quality assurance network attached to the storage back end running an unsecured wireless network provides "free" wireless to the surrounding buildings and passersby allowing anyone to hop onto the network and do basically anything they want to servers and storage systems.
A bot or rootkit-infected storage server that provides complete remote control to an attacker and facilitates unauthorized access to all connected storage systems.
Similar problems can be created when storage systems are in the DMZ. A situation can even be created where authorized internal users are able to snoop around and exploit a vulnerable system to gain access to the DMZ or other protected network segment. The following figure shows these storage bridging weaknesses.
Either way, the false sense of security that a firewalled and segmented network brings introduces serious security issues for the storage environment and the network as a whole.
Don't get me wrong -- firewalls and firewall DMZs in and of themselves do offer a layer of protection. Especially those with application layer defenses. It's when the human element gets involved for technical reasons, limited budget or for the sake of convenience that the protection offered by firewall segmentation is negated.
Take a step back and draw out your network environment. Can any one system on any one network segment connect to another one if everything fell into place? The answer is' most likely yes. If it is, or if you're unsure, it may be time to reassess your firewall dependence and, instead, rely upon better storage-centric defenses, such as zoning, LUN masking, port locking, etc., for SANs, as well as VLAN isolation and even network and/or host-based intrusion prevention systems for NAS systems. You'll ward off the unwanted and the unexpected much more effectively this way.
About the author: Kevin Beaver is an independent information security consultant, speaker and expert witness with Atlanta-based Principle Logic LLC. He has more than 18 years of experience in IT and specializes in performing information security assessments revolving around compliance and IT governance. Kevin is the creator and producer of Security On Wheels and has written six books, including Hacking For Dummies and Hacking Wireless Networks For Dummies (Wiley,) as well as The Practical Guide to HIPAA Privacy and Security Compliance (Auerbach). He can be reached at kbeaver ~at~ principlelogic.com.
