Security Looms Large at Storage Networking World

DALLAS -- Security may not be top of mind for every storage professional, but attendees at this week's Storage Networking World were told that it may soon become a big part of their daily operations.

With another data tape loss as a backdrop, this time involving Iron Mountain and the Louisiana Office of Student Financial Assistance, attendees got a sense of just how far-reaching storage vulnerabilities are and the steps that are needed to control them.

Keynote speaker Frank Abagnale, known to many in attendance from the movie "Catch Me If You Can," set the stage for security considerations with his humorous yet sobering story of how a teenager could assume the role of an airline pilot and pediatrician in lax security environments. Abagnale maintained that fraud and identity theft continue to be major issues that should not be dismissed by organizations.

A number of users concurred that storage security issues often get overlooked, and a session by TD Ameritrade put forth the premise that they could be bigger than traditional operating system or network security issues. First steps to storage security include examining a variety of vulnerability points, securing how individuals legally access data, and combining those activities with support of network protocols, storage devices and the operating systems they run on.

An Introduction to Storage Security session presented by Andrew Nielsen of Hitachi drew a room full of attendees, who concurred that data center security concerns include ongoing attacks from internal and external sources, concentration of information in high-density storage devices, increased use of automation, and data protection and privacy regulations.

Nielsen said security requires auditability and accountability, access control, integrity and asset availability, and a comprehensive and integrated approach. The first steps are balancing security with compliance, leveraging security frameworks provided by ISO, CoBIT, and NIST, and ITIL, and following best current practices. Those practices include identifying and assessing all storage interfaces, creating risk domains, monitoring and controlling physical access, avoiding failure due to common mistakes, implementing disaster recovery and business continuity, and aligning storage and policies.

Security is a people problem, and the most significant security risks in storage networks may not be the obvious ones, he said. Nielsen challenged attendees to look for insider attacks, protect critical and regulated data, and have a detailed plan to deal with data security incidents.