- Introduction
- Basic Security Principles
- Data Management: Determining and Maintaining Ownership
- Data Governance Policies
- Roles and Responsibilities
- Data Ownership
- Data Custodians
- Data Documentation and Organization
- Data Warehousing
- Data Mining
- Knowledge Management
- Data Standards
- Data Lifecycle Control
- Data Audits
- Data Storage and Archiving
- Data Security, Protection, Sharing, and Dissemination
- Privacy Impact Assessment
- Information Handling Requirements
- Record Retention and Destruction
- Data Remanence and Decommissioning
- Classifying Information and Supporting Asset Classification
This chapter is from the book
This chapter is from the book
This chapter is from the book
Data Storage and Archiving
Organizations have a never-ending need for increased storage. Whereas thumb drives were revolutionary and initially provided in the range of 10 MB of storage, today they can provide terabytes of storage. Data storage options in organizations typically include the following:
Network attached storage (NAS)- Storage area network (SAN)
- Cloud
Organizations should fully define their security requirements for data storage before deploying a technology. For example, NAS devices are small, easy to use, and can be implemented quickly, but physical security is a real concern, as is implementing strong controls over the data. A SAN can be implemented with much greater security than can a NAS. Cloud-based storage offers yet another option but also presents concerns, including the following:
- Is it a private or public cloud?
- Does it use physical or virtual servers?
- How are the servers provisioned and decommissioned?
- Is the data encrypted and, if so, what kind of encryption is used?
- Where is the data actually stored?
- How is the data transferred (data flow)?
- Where are the encryption keys kept?
- Are there co-tenants?
Keep in mind that storage integration also includes securing virtual environments, services, applications, appliances, and equipment that provide storage.
The Storage Networking Industry Association (SNIA) defines a SAN as “a data storage system consisting of various storage elements, storage devices, computer systems, and/or appliances, plus all the control software, all communicating in efficient harmony over a network.” A SAN appears to the client OS as a local disk or volume that is available to be formatted and used locally as needed.
For the CISSP exam, it is important to know the following terms related to SANs:
- Virtual SAN: A virtual SAN (VSAN) is a SAN that offers isolation for devices that are physically connected to the same SAN fabric. The use of VSANs is sometimes called fabric virtualization. VSANs were developed to support independent virtual fabrics on a single switch. VSANs improve consolidation and simplify management by allowing for more efficient SAN utilization. A VSAN allows a resource on any individual VSAN to be shared by other users on a different VSAN without requiring the SAN fabrics to be merged.
- Internet Small Computer System Interface (iSCSI): iSCSI is a SAN standard used for connecting data storage facilities and allowing remote SCSI devices to communicate. Many see it as a replacement for Fibre Channel because it does not require any special infrastructure and can run over existing IP LAN, MAN, or WAN networks.
- Fibre Channel over Ethernet (FCoE): FCoE, a transport protocol that is similar to iSCSI, can operate at speeds of 10 Gbps and rides on top of the Ethernet protocol. While it is fast, it has a disadvantage in that it is non-routable. By contrast, iSCSI is routable because it operates higher up the stack, on top of the TCP and UDP protocols.
- Host bus adapter (HBA) allocation: A host bus adapter is used to connect a host system to an enterprise storage device. HBAs can be allocated either through soft zoning or persistent binding. Soft zoning is more permissive, whereas persistent binding decreases address space and increases network complexity.
- LUN masking: LUN masking is implemented primarily at the HBA level. It is a system that makes LUNs available to some HBAs but not to others. LUN masking implemented at this level is vulnerable to any attack that compromises the local adapter.
- Location redundancy: Location redundancy makes contents accessible from more than one location. An extra measure of redundancy can be provided by means of a replication service so that data is available even if the main storage backup system fails.
- Secure storage management and replication: Secure storage management and replication systems are designed to allow an organization to manage and handle all its data in a secure manner with a focus on the confidentiality, integrity, and availability of the data. A replication service allows the data to be duplicated in real time so that additional fault tolerance is achieved.
- Multipath solutions: Enterprise storage multipath solutions reduce the risk of data loss or lack of availability by setting up multiple routes between a server and its drives. The multipath software maintains a listing of all requests, passes them through the best possible path, and reroutes communication if a path fails.
- SAN snapshots: SAN snapshot software is typically sold with SAN solutions and offers a way to bypass typical backup operations. The snapshot software has the ability to temporarily stop writing to a physical disk and then make a point-in-time backup copy. Snapshot software is typically fast and makes a copy quickly, regardless of the drive size.
- Data de-duplication (DDP): Data de-duplication is the process of removing redundant data to improve enterprise storage utilization. Redundant data is not copied. It is replaced with a pointer to the one unique copy of the data. Only one instance of redundant data is retained on the enterprise storage medium, such as disk or tape.