What problem you will solve with this tip: Learn where storage security vulnerabilities exist and how your systems are likely to be attacked.
Storage security vulnerabilities abound. You likely know of many and likely haven't thought about others. What's causing the problem, and what should you be looking out for? It's just a matter of time before something on the network -- a router, a server, a Web application -- is exploited by an external attacker or malicious insider. With the increased visibility and avenues of attack, your storage systems are no different. I'm not speaking gloom and doom, just being realistic.
How storage got pulled into the problem
Like anything else IT-related, there are vulnerabilities that can lead to business risks within your storage environment. It's not the mere fact that storage systems are susceptible to attack that makes this a big deal; nor is it related to the fact that storage security easily falls within the scope of your organization's compliance initiatives. Instead, it involves things like having to secure multiple layers of systems that support your storage environment, such as physical access, network configuration and transport, authentication mechanisms, management tools and so on. There's also the fact that various business processes, such as information classification, legal discovery, user provisioning, system monitoring and ongoing auditing, apply directly to storage.
In the past, the complexities associated with storage systems, network isolation and lack of storage knowledge have kept most attackers at bay. The tides are turning, and now the bad guys understand what storage is about and how it works. They're discovering the multiple avenues for accessing the storage environment and utilizing storage-specific hacking tools to try and get to your systems. So, regardless of what storage technologies you use and how they're configured, there's near a 100% certainty that your systems
To continue reading for free, register below or login
To read more you must become a member of SearchStorage.com
are at risk and will continue to be.
Here's why and how your storage environment will be attacked.
Common misconceptions and oversights
Regardless of how your organization's data is created, handled or otherwise processed, it will inevitably end up in your storage environment. You're going to have to be prepared to keep it locked down and inaccessible from unauthorized people the best you can. Acknowledging this fact is half the battle, especially if you work closely with your information security team or any others that are responsible for protecting electronic assets.
There are other issues that aren't quite as simple. In fact, many are outright falsehoods based on "old-school" thinking and a general lack of information security knowledge. In no particular order, here are seven issues you, as a storage administrator or manager, will have to overcome in order to keep your storage systems secure and make improvements long term:
How it will happen
When you combine the problems outlined above with your system complexities and difficulties of keeping everything within your sights at all times, this will inevitably lead to an unnecessary or unauthorized storage exposure. There are hundreds of ways for storage systems to be attacked. They'll come from within your own network and from the outside, but here are seven biggies:
Over the years, there has been a disconnect between storage administration and information security, which has helped facilitate these storage system attacks. There's a lot of payoff associated with doing something about the problem. If you start working on fixing the underlying issues that are contributing to this within your organization, you'll be well ahead of your peers and on the path toward improving your overall storage skill set and keeping your organization's storage security in check.
About the author: Kevin Beaver is an independent information security consultant, speaker and expert witness with Atlanta-based Principle Logic LLC. He has more than 18 years of experience in IT and specializes in performing information security assessments revolving around compliance and IT governance. Kevin has written six books, including Hacking For Dummies and Hacking Wireless Networks For Dummies (Wiley), as well as The Practical Guide to HIPAA Privacy and Security Compliance (Auerbach). He can be reached at kbeaver ~at~ principlelogic.com.
