Storage security and the firewall DMZ problem

Storage security and the firewall DMZ problem

What you will learn from this tip: Firewalls are often relied upon too much for network security -- especially when it comes to locking down the storage environment. Learn how this firewall demilitarized zone (DMZ) security misconception unnecessarily exposes many critical storage systems and how you can avoid this problem.

There's a misconception going around in storage circles that as long as

    Requires Free Membership to View

    Login

    When you register for SearchStorage.com, you’ll also receive targeted emails from my team of award-winning editorial writers. Our goal is to keep you informed on the hottest topics, the latest news and the biggest challenges you face as a storage professional today.

    Rich Castagna, Editorial Director

    By submitting your registration information to SearchStorage.com you agree to receive email communications from TechTarget and TechTarget partners. We encourage you to read our Privacy Policy which contains important disclosures about how we collect and use your registration and other information. If you reside outside of the United States, by submitting this registration information you consent to having your personal data transferred to and processed in the United States. Your use of SearchStorage.com is governed by our Terms of Use. You may contact us at webmaster@TechTarget.com.

storage area network (SAN) and network attached storage (NAS) systems are behind a firewall then everything's protected. This simply isn't true. Like most firewall misunderstandings, relying on this type of protection is dangerous at best and isn't a good long-term solution to keep your storage systems safe and sound. Let me explain.

Storage security information
The burning issue of vault storage

The problem with unstructured information

IBM, Sun tout native tape encryption
Most storage environments span across multiple networks. Both private and public network segments are often served simultaneously. Be it external Web servers in the DMZ, internal file servers on the internal LAN -- you name it. Serving up multiple network segments creates a virtual bridge effectively negating any network segmentation and firewall. With this configuration, any vulnerable system can be used as a conduit into the storage environment. This happens when a system, such as a Web server, database server or file server on one network segment, is attacked and a conduit of sorts is created via the storage back end to adjacent network segments, essentially bypassing any firewall protection. This may include:

  • An email server missing a patch, easily exploitable via one of the numerous hacking tools, such as Metasploit, provides the attacker a command prompt and direct access to the attached storage systems or even other internal network systems.

  • A storage management server that happens to be running Windows Terminal Services that can be easily brute-force attacked using a tool, such as TSGrinder, provides direct access into the storage environment.

  • A software quality assurance network attached to the storage back end running an unsecured wireless network provides "free" wireless to the surrounding buildings and passersby allowing anyone to hop onto the network and do basically anything they want to servers and storage systems.

  • A bot or rootkit-infected storage server that provides complete remote control to an attacker and facilitates unauthorized access to all connected storage systems.

    • Similar problems can be created when storage systems are in the DMZ. A situation can even be created where authorized internal users are able to snoop around and exploit a vulnerable system to gain access to the DMZ or other protected network segment. The following figure shows these storage bridging weaknesses.

    Either way, the false sense of security that a firewalled and segmented network brings introduces serious security issues for the storage environment and the network as a whole. Don't get me wrong -- firewalls and firewall DMZs in and of themselves do offer a layer of protection. Especially those with application layer defenses. It's when the human element gets involved for technical reasons, limited budget or for the sake of convenience that the protection offered by firewall segmentation is negated.

    Take a step back and draw out your network environment. Can any one system on any one network segment connect to another one if everything fell into place? The answer is' most likely yes. If it is, or if you're unsure, it may be time to reassess your firewall dependence and, instead, rely upon better storage-centric defenses, such as zoning, LUN masking, port locking, etc., for SANs, as well as VLAN isolation and even network and/or host-based intrusion prevention systems for NAS systems. You'll ward off the unwanted and the unexpected much more effectively this way.

    About the author: Kevin Beaver is an independent information security consultant, speaker and expert witness with Atlanta-based Principle Logic LLC. He has more than 18 years of experience in IT and specializes in performing information security assessments revolving around compliance and IT governance. Kevin is the creator and producer of Security On Wheels and has written six books, including Hacking For Dummies and Hacking Wireless Networks For Dummies (Wiley,) as well as The Practical Guide to HIPAA Privacy and Security Compliance (Auerbach). He can be reached at kbeaver ~at~ principlelogic.com.


    This was first published in January 2007

    Disclaimer: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.

    Back to top