SAN Security

Data is the currency of today's enterprises. While loss of data access can cost up to millions of dollars per outage, loss of sensitive data to a competitor or hacker can be catastrophic. Enterprise networks therefore go to great lengths to ensure data security for their mission-critical information, and in particular for the security of data on disk. Data centers typically maintain secure physical access to safeguard corporate information from outside penetration. In addition, conventional direct-attached storage itself provides inherent security since storage arrays are bound by parallel cabling directly to servers. The introduction of SANs, however, has changed this view of secure data storage. SANs bring networking between servers and storage to solve availability and storage consolidation issues, but with peer-to-peer networking technology there is always the potential for unsecured access.

Consequently, running storage data over SANs invariably raises the issue of security. First generation Fibre Channel SANs have relied on the implicit security provided by data center environments. When SAN resources are shared between multiple departments, however, physical isolation of the SAN may not be sufficient. Human resources and engineering, for example, may share a Fibre Channel fabric switch, with each department maintaining its own storage resources. To preserve the privacy of human resources information from the prying eyes of engineers, it is necessary to logically separate the SAN. In Fibre Channel fabric switches, this function is provided by zoning. Zoning allows a single physical SAN to be divided into logical storage access groups. In this example, human resources would reside in one zone, and engineering in another. The Fibre Channel fabric switches enforce separation of data traffic so that only zoned participants can communicate to their designated resources. Overlapping zones enable authorized resources to be grouped for specific functions. Although human resource and engineering servers are zoned apart, both could be zoned into a third access group to a common tape backup subsystem.

Still, zoning does not address the security of data in transit over a link. Even with zoning, it is possible for someone to sniff the link with an analyzer and capture data. This vulnerability is especially evident when storage data is run over longer unsecured distances, for example over a metropolitan link provided by a carrier. Native Fibre Channel and Fibre Channel extension via DWDM lack an integrated security option. Until recently, there has been no means to encrypt the storage data before it leaves the premises and enters the long haul.

Ironically, data security for Fibre Channel SANs can be resolved by enhanced capabilities introduced by a competing technology: IP SANs. IP-based storage networking can leverage well-established security mechanisms such as IPSec (IP Security) to provide sophisticated data encryption for storage traffic. Newly introduced IP storage switches enable Fibre Channel hosts and storage devices to connect to Gigabit Ethernet switches and IP routers. While some IP routers offer integrated IPSec capability, there are also third-party encryption devices that can be paired across an untrusted link. These products use the Data Encryption Standard (DES) or the more rigorous triple-DES algorithm to thoroughly encrypt sensitive data. Some products also provide gigabit interfaces for optimum throughput. By integrating Fibre Channel storage and servers with IP infrastructures, network administrators can insure the security of storage data for any network segments that may be vulnerable to penetration.

Security for SANs is gaining increasing attention as enterprise networks expand their disaster recovery and remote backup strategies. In addition, SAN-based storage is gradually displacing direct-attached storage over time, thus widening the scope of security concerns. The introduction of IP storage networking is alleviating those concerns by bringing enhanced security features to traditional Fibre Channel SAN technology.