VARs can often find the weaknesses in a customer's storage security by testing the system that is in place. By hacking into a customer's system, VARs can find the backdoors and loopholes that someone mounting a malicious attack can use as an entry way to critical data. Do these vulnerable points exist because of poor security management? Can they be fixed by implementing more effective storage security practices? Kevin Beaver offers his technical advice on why it is necessary for VARs to establish security protocols.
Hack your storage to test your security
When it comes to testing for vulnerabilities in storage systems (DAS, NAS, and SANs), it's easy to overlook weaknesses that may be obvious to a malicious insider or other attacker. From perimeter security weaknesses to insider advantages, such as knowing just where sensitive storage devices are located, these kinds of hit-or-miss issues will get you every time.
Any storage system that supports typical network protocols and file systems (HTTP, FTP, CIFS, NFS, etc.) will also inherit any vulnerabilities associated with those protocols; likewise for operating system configuration weaknesses, software exploits, password problems, Web applications and more. At a minimum, you should perform the following security tests (a.k.a. ethical hacks) on your storage system to find holes and fix them before someone exploits them. Keep in mind that certain tests will vary (or not apply) depending upon the type of storage system you have and its underlying operating system (OS), as well as the type of network and/or physical access obtained.
- Scan the system to discover open ports, listening services, banner pages, missing patches, Web application and/or database concerns and exploitable weaknesses.
- Enumerate the system to find available shares, exports, users, security policies and more.
- Sniff network traffic to discover clear-text usernames and passwords that can be used to further penetrate storage devices. For SAN environments, Fibre Channel, switch and management information can be discovered in clear-text traffic.
Read the rest of Beaver's article at SearchStorage.com
Effective storage security policies
There are a lot of sample information security policies floating around the Internet. If you know which policies you need, you can even purchase policy templates if you're willing to spend the money. So, what does it mean and what does it take to have a practical set of storage security policies that can work for you in the real world?The bottom line is that you've got to know which risks are present in your storage systems and which ones would have the greatest impact and likelihood of occurrence before you can implement the appropriate policies and supporting controls.
In order to stay organized and keep things simple, you'll need to have a standard security policy template. This will make policy creation and maintenance so much simpler in the long-term than simply bundling everything into one large and unorganized document.
Now it's time to create your actual policies. Remember -- create policies based on risks discovered and business needs. However, the following policies should be on your radar as they all relate to storage security in one way or another:
- Access controls -- admin rights, file/share permissions, cryptographic controls, zoning configurations, etc.
- Change management -- why, when, who, testing requirements, backout procedures, etc.
- System monitoring and incident response -- real-time monitoring, audit logs, incident response plan requirements, etc.
- User authorization -- granting access -- who, what, when, how long, etc.
Read the rest of Beaver's article at SearchStorage.com
About the author: Kevin Beaver is an independent information security consultant, author and speaker with Atlanta-based Principle Logic, LLC. He has more than 18 years of experience in IT and specializes in performing information security assessments. Kevin has written five books including Hacking For Dummies (Wiley), Hacking Wireless Networks For Dummies, and The Practical Guide to HIPAA Privacy and Security Compliance (Auerbach). He can be reached at kbeaver @ principlelogic.com.
