Storage security is a specialty area of security that is concerned with securing data storage systems and ecosystems and the data that resides on these systems.
According to the Storage Networking Industry Association (SNIA), storage security represents the convergence of the storage, networking, and security disciplines, technologies, and methodologies for the purpose of protecting and securing digital assets.[1] Historically, the focus has been on both the vendor aspects of making storage product more secure and the consumer aspects associated with using storage products in secure ways.
Technical controls, which may include integrity, confidentiality and availability controls, that protect storage resources and data from unauthorized users and uses.
ISO/IEC 27040 provides the following more comprehensive definition for storage security:
application of physical, technical and administrative controls to protect storage systems and infrastructure as well as the data stored within them
Note 1 to entry: Storage security is focused on protecting data (and its storage infrastructure) against unauthorized disclosure, modification or destruction while assuring its availability to authorized users.
Note 2 to entry: These controls may be preventive, detective, corrective, deterrent, recovery or compensatory in nature.
Principles of Security Storage
This section needs expansion. You can help by adding to it. (May 2017)
Confidentiality: Only authorized users will have access to the data locally or through network.[3]
Availability: Manage and minimize the risk of inaccessibility due to deliberate destructions or accidents such as natural disaster, mechanical and power failures. [4]
Data sanitization is a practice in which storage mediums are destroyed on-site. For instance if a hard-drive needs to be upgraded or replaced, it would be considered insecure to sell or recycle the drive since it is possible traces of the data may still exist even after formatting. Therefore destroying the drive rather than allowing it to leave the site is a common practice.[5]
Relevant standards and specifications
Applying security to storage systems and ecosystems requires one to have a good working knowledge of an assortment of standards and specifications, including, but not limited to:
ISO Guide 73:2009, Risk management — Vocabulary
ISO 7498-2:1989, Information technology — Open Systems Interconnection — Basic Reference Model — Part 2: Security Architecture
ISO 16609:2004, Banking — Requirements for message authentication using symmetric techniques
ISO/PAS 22399:2007, Societal security — Guideline for incident preparedness and operational continuity management
ISO/IEC 10116:2006, Information technology — Security techniques — Modes of operation for an n-bit block cipher
ISO/TR 10255:2009, Document management applications — Optical disk storage technology, management and standards
ISO/TR 18492:2005, Long-term preservation of electronic document-based information
ISO 16175-1:2010, Information and documentation — Principles and functional requirements for records in electronic office environments — Part 1: Overview and statement of principles
ISO 16175-2:2011, Information and documentation — Principles and functional requirements for records in electronic office environments — Part 2: Guidelines and functional requirements for digital records management systems
ISO 16175-3:2010, Information and documentation — Principles and functional requirements for records in electronic office environments — Part 3: Guidelines and functional requirements for records in business systems
ISO/IEC 17826:2012, Information technology — Cloud Data Management Interface (CDMI)
ISO/IEC 19790:2006, Information technology — Security techniques — Security requirements for cryptographic modules
ISO/IEC 24759:2008, Information technology — Security techniques — Test requirements for cryptographic modules
ISO/IEC 24775, Information technology — Storage management (to be published)
ISO/IEC 27000:2014, Information technology — Security techniques — Information security management systems — Overview and vocabulary
ISO/IEC 27001:2013, Information technology — Security techniques — Information security management systems — Requirements
ISO/IEC 27002:2013, Information technology — Security techniques — Code of practice for information security controls
ISO/IEC 27003:2010, Information technology — Security techniques — Information security management systems implementation guidance
ISO/IEC 27005:2008, Information technology — Security techniques — Information security risk management
ISO/IEC 27031:2011, Information technology — Security techniques — Guidelines for information and communication technology readiness for business continuity
ISO/IEC 27033-1:2009, Information technology — Security techniques — Network security — Part 1: Overview and concepts
ISO/IEC 27033-2, Information technology — Security techniques — Network security — Part 2: Guidelines for the design and implementation of network security
ISO/IEC 27033-3:2010, Information technology — Security techniques — Network security — Part 3: Reference networking scenarios — Threats, design techniques and control issues
ISO/IEC 27033-4:2014, Information technology — Security techniques — Network security — Part 4: Securing communications between networks using security gateways
ISO/IEC 27037:2012, Information technology — Security techniques — Guidelines for identification, collection, acquisition, and preservation of digital evidence
ISO/IEC/IEEE 24765-2010, Systems and software engineering — Vocabulary
IEEE 1619-2007, IEEE Standard for Wide-Block Encryption for Shared Storage Media
IEEE 1619.1-2007, IEEE Standard for Authenticated Encryption with Length Expansion for Storage Devices
IEEE 1619.2-2010, IEEE Standard for Cryptographic Protection of Data on Block-Oriented Storage Devices
IETF RFC 1813 NFS Version 3 Protocol Specification
IETF RFC 3195 Reliable Delivery for syslog
IETF RFC 3530 Network File System (NFS) version 4 Protocol
IETF RFC 3720 Internet Small Computer Systems Interface (iSCSI)
IETF RFC 3723 Securing Block Storage Protocols over IP
IETF RFC 3821 Fibre Channel Over TCP/IP (FCIP)
IETF RFC 4303 IP Encapsulating Security Payload (ESP)
IETF RFC 4595 Use of IKEv2 in the Fibre Channel Security Association Management Protocol
IETF RFC 5246 The Transport Layer Security (TLS) Protocol Version 1.2
IETF RFC 5424 The Syslog Protocol
IETF RFC 5425 TLS Transport Mapping for Syslog
IETF RFC 5426 Transmission of Syslog Messages over UDP
IETF RFC 5427 Textual Conventions for Syslog Management
IETF RFC 5661 Network File System (NFS) Version 4 Minor Version 1 Protocol
This page is based on this Wikipedia article Text is available under the CC BY-SA 4.0 license; additional terms may apply. Images, videos and audio are available under their respective licenses.
