Practical Secure Storage
September 17, 2014, Storage Developer Conference, Santa Clara, CA—Walt Hubis from Hubis Technical Associates presented a vendor agnostic overview of secure storage. this information includes current and emerging technologies and changes in international security standards to implement a practical and secure storage system.
The first area to consider is encryption. The drivers for this level of security are regulatory obligations, legal and corporate requirements, sanitization through cryptographic erasure, and a safe harbor for breach notification. The regulatory obligations vary by region, with US having Sarbanes-Oxley, HIPAA, and national security, while the EU has data privacy and protection requirements.
Within any region there are also legal obligations including court orders, contracts, trade secrets and IP, and other competitive information. Al require due care to preserve their status. Corporate requirements center around management concerns like public image, protecting intellectual property, and thwarting or detecting criminal activity and providing traceability for obligations and requirements. Organizational policies may call for defined retention, destruction, and privacy issues. Protecting the data also impacts other areas and could be important for future states, tracking and monitoring access and intrusion, and as a facet for audits.
A part of the process is to determine what to protect. Valuable data needs redundancy, disaster protection, and replication, while sensitive data require confidentiality, access control, integrity, and immutability. Different mechanisms take precedence for sensitive versus valuable data. All sensitive data are valuable.
Once the audits are completed, the organization has to match confidentiality priorities to categories. Some possible categories are most confidential, competitively sensitive, personally identifiable information, top secret, restricted financial, etc. The data assets inventory must include applications which touch the data, hosts and servers to include OS, access, use, and storage, and information on the data owners. This inventory should cover the various networks involved, their geographic locations, and a risk assessment to clearly delineate security domains.
The security issues must address data flow from temporary storage, caches, data mirrors, mobile devices, backup and archives, and compression and duplication. Any of thee points are candidates for encryption. At the application level, the applications and databases must be secured. The file systems need to be protected and hardened, especially for OS-level applications. Host bus adapters, array controllers and switch level that are not completely inside a secure area need protection. One good item is that devices now can be self-encrypting and sanitized via cryptographic erase.
One challenge is that data traversing ports have to be encrypted from end to end, leading to problems with de-duplication and compression. The keys for the in-flight data should be ephemeral while the keys for data at rest should be long-lived. For the secure appliances, scalability may be an issue as high speed data has to be encrypted at line rates for everything entering and leaving the secure areas. Here, self-encrypting disks may be a partial solution that moves the encryption closer to the data. There are some issues with SEDs as boot devices, but the SEDs do offer theft and loss protection at relatively low cost.
Securing a NAS allows for encryption at the storage array and can be a hybrid of secure and non-secure volumes and drives. The NAS provides protection for loss or theft of the disks. One way to implement a secure NAS is to use SEDs as part of a RAID configuration to make all drives including non-SED drives secure. An alternative is to have external encryption on some of the drives in the RAID.
The security domains establish perimeters for the data. A secure NAS appliance also needs physical security and all data must be secured across the boundaries. Special considerations need to be applied for the movement of physical data such as tapes, drives, etc. The extension of the security domains across geographic areas must encrypt the data in motion and must consider the different transport mechanisms to the external carrier(s).
The complexity of the transport media and protocol translations requires equally complex key management. The key manage protocols for the local HBA and storage are different from those for SEDs and servers. The VPN server has another protocol to address its unique needs, and the storage arrays and libraries have still another management protocol. All the different protocols are needed due to the different levels of access and use for the various components. The complexity is somewhat mitigated with an enterprise key manage server with an interoperability protocol.
There are many types of keys and uses for each type. The major issues are confidentiality, integrity, availability, and the prevention of misuse. Loss of keys is equated to data loss, and key availability is data availability. Keys have lifecycles just like data, but on different time scales. Keys have to be generated, protected and processed, and checked for expiration and compromise on every use, then must be disabled or destroyed if it is no longer acceptable. All keys should be strong—many characters, not all letters, etc. – and need sufficient entropy.
