Security breaches are a constant threat to organizations, and while securing primary storage is a top priority another challenge is making sure data is secure as various processes copy it. Organizations copy data for many legitimate reasons; backup, test-dev, and analytics to name a few. As the organization copies data, the data moves to other storage systems. Those systems may not have the same security attributes as the primary storage system. IT needs to make sure that data is secure throughout its lifecycle.
Create a Self-Protecting Storage Infrastructure
The first step in creating a secure end-to-end storage infrastructure is to make sure that production data is itself secure. One of the best methods for securing production storage is to select a storage system that has always-on encryption which encrypts data from the moment it is first created and throughout its lifecycle. The problem is that even if the primary storage system is secure, as the organization continuously makes copies of data, it moves them to systems that may not be as secure or have an entirely different security scheme.
Creating an ideal secure end-to-end storage infrastructure requires minimizing data movement so that the organization can store all data, including copies on a single system and that system manages all data security and protection. Of course, that system still needs to be externally protected via replication or backup. If the primary storage system is in control of protection, IT can limit the number of “super-user” accounts it needs to create. However, such a design is not practical when viewed from a disaster recovery (DR) perspective.
The primary storage system has to manage the copy data function by leveraging snapshots. The snapshot feature needs to have no restrictions on the number taken or the performance impact of taking them. If the storage system is going to provide most of the protection, then it also needs to support both flash media for active workloads and hard disk drives for in-active data.
Snapshots have one weakness; they are entirely dependent on the integrity of the original volume. If the volume fails, then the data contained in the snapshots of that volume fail with it. Production storage systems that protect themselves need to provide the ability to create clones from snapshots so that a stand-alone copy of data exists.
Protection from Disaster
There is also the concern if the storage system fails which means that even cloned volumes are at risk. The storage system should have replication features built in to at a minimum replicate all data off-site and preferably have an additional system on-site as a replication target. Each system is controlled and secured by the same storage software.
Protection from Ransomware and other Breaches
Data encryption won’t always protect against a ransomware attack. If the malware can authenticate itself it “sees” all data as unencrypted, just as a user would. The two or three systems described above need to be on separate snapshot schedules, and these snapshots should be set to read-only to make sure that the organization has an acceptable roll-back point.
The storage system also needs to do more than encrypt since, as ransomware proves, once the malware or attacker authenticates itself, it has full access to the data on the storage system. Disgruntled users pose the same threat since they authenticate at login. The secure end-to-end storage system, because of its built-in protection, limits exposure since there are a finite number of super-user accounts IT needs to create. Beyond limiting exposure, the system needs to provide analytics that constantly monitor data on the system, alerting IT to any anomalies, like a significant number of file changes.
StorageSwiss Take
The perimeter defenses organizations use to protect against security breaches, although necessary, eventually, get compromised. IT needs to make sure it protects all data, and it can limit the severity of an attack. The first line of defense is encryption, but encryption has to be universal and applied across all data and its copies. The second line of defense is the constant and rapid creation of data copies from which the organization can recover. Finally, IT needs analytics and auditing to determine an attack is underway, how to stop it and which data is the best from which to recover.
To learn more about building a secure storage infrastructure watch our on demand webinar “Three Reasons Storage Security is Failing and How to Fix It.” By registering for the on demand webinar, you’ll also gain access to Storage Switzerland’s latest eBook “Designing Storage for Cyber Security.”
George Crump is the Chief Marketing Officer at VergeIO, the leader in Ultraconverged Infrastructure. Prior to VergeIO he was Chief Product Strategist at StorONE. Before assuming roles with innovative technology vendors, George spent almost 14 years as the founder and lead analyst at Storage Switzerland. In his spare time, he continues to write blogs on Storage Switzerland to educate IT professionals on all aspects of data center storage. He is the primary contributor to Storage Switzerland and is a heavily sought-after public speaker. With over 30 years of experience designing storage solutions for data centers across the US, he has seen the birth of such technologies as RAID, NAS, SAN, Virtualization, Cloud, and Enterprise Flash. Before founding Storage Switzerland, he was CTO at one of the nation's largest storage integrators, where he was in charge of technology testing, integration, and product selection.
StorageSwiss.com - The Home of Storage Switzerland 