Storage Security

shiroi_kami writes "What does Information Security mean to you? To many, it means firewalls and encryption. To some, it means intrusion detection systems. Chances are the words "file servers" weren't high on your list, but they probably should be. After all, information security is about information, and when it's not flying across the network it's got to be stored somewhere, right? In fact, the security of the storage mechanism is often overlooked, which makes it an attractive target for attackers. In their new book, Storage Security, the authors take a comprehensive look at this often-ignored subject. Update: 03/26 05:44 GMT by T : Please note, this review was written by David Bianco under the handle shiroi_kami as an Amazon.com review, and also appears at InfosecBooks.com. Apologies to David for the misplaced and delayed attribution. Storage Security: Protecting, SANs, NAS and DAS author John Chirillo, Scott Blaul pages 408 publisher John Wiley & Sons rating 9.8 reviewer David Bianco ISBN 0764516884 summary A storage security handbook that examines strengths and weaknesses, describes architectural security concerns and considerations, and identifies ways to implement and design more secure storage systems.

Storage Security is not about turning on the right configuration options on your XYZ brand server appliance. It's about applying solid, methodical security practices to your storage systems, regardless of whether they are disks directly attached to a single computer, Network Attached Storage or part of a Storage Area Network. The authors address the full security cycle, too, starting with evaluating the security of proposed new storage solutions. Comparative data in hand, the book shows you how to narrow the field to a single solution that offers the best balance between functionality and security.

And once the system is selected, you can't stop there. You've got to decide on appropriate security policies for the new storage system, draft and implement a backup and restore plan, deal with disaster recovery and take care of a host of other issues. In short, this is a good guide to an entire range of considerations necessary to select, deploy and manage a secure storage solution.

The book's evaluation methodology is particularly valuable. Each type of storage (directly attached, NAS and SAN) is covered in a chapter of its own. Within each chapter, the authors address specific technologies used to implement that type of storage. For example, the direct-attach chapter discusses such common storage technologies as SCSI and IDE, moderately exotic systems like USB and Firewire drives, and some more advanced solutions like HiPPI and SSA. Each technology is then placed in a matrix and scored in 11 different categories, including popularity and industry acceptance, built-in data protection features, typical fault tolerance and physical security characteristics.

The authors assign each rating on a scale of 1 (poor) to 5 (the best). This gives a good general indication of how each technology measures up, but they tend to rely on a straight average of the ratings when determining the best technology. Although it's true that the average allows you to make a quick ballpark comparison, there are many other factors to consider as well, such as the suitability for your particular environment and the way in which your users need to access their data. The matrixes are quite useful, but just remember that you can't always boil things down to a simple numerical score.

Probably the biggest problem with this book is that it's pretty dry. As a reference book, the writing style is fine, since it's easy to find what you're looking for, and the chapters are concise. It's difficult to read from cover-to-cover, though, which is a shame because that's what you should probably do the first time through. Take it in small doses, a chapter or so at a time, and you should be fine.

Storage Security is about just what you'd think: the security of your data as it's being stored on your server(s). It's not a detailed look at the configuration of any one product, but rather a comprehensive, theory-based approach to managing the security of your storage subsystem from evaluation to purchase to daily operations. If you manage a small or mid-size network, you may or may not need this book. If you have a larger network, though, or have significant data-storage needs, this deserves a space on your shelf.

You can purchase Storage Security: Protecting, SANs, NAS and DAS from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

Comments

Please Help

[Anonymous Coward]

Dear sirs,

I am having a computer related problem, and was hoping that you, being mainly technically minded could help.

Up until recently I was a proficient Java programmer, and the code that I released for my company earned us a significant revenue. I used the various coding tools available to me on the robust platform of Microsoft Windows 2000 and all of the user friendliness and support it has to offer.

Recently, I was involved in an accident which left me immobile in hospital for a couple of months. In this time, without the ability to excercise, I began to gain weight, and would now go as far as to say I am fat. Also, because I could not get a haircut easily, my hair is long and unkempt. Fortunately, I have made a full recovery and since left hospital and gone back to work.

Here is the problem:

Now at work, I refuse to use Java, instead prefering to use what I used to think was a garbled mess of inefficiency - perl. Not only that, but once I have completed any code (which takes a lot longer than it used to with Java - but it can't be perl's fault because perl is perfect) I now genuinely believe that giving away the past few months worth of work for free is a valid business model! Equally, my productivity has plummeted because I have switched from Windows to Linux, as I now realise that it is better to write a 75 line bash script to copy files than to drag and drop in explorer - I think it has something to do with being l337 and having control, not like you M$ Windoze lusers LOL!!

Clearly something is wrong with me and I would love to know what it is. Does anybody know why I have lost all common sense, personal hygiene, business sense and instead gained the ability to program in a rune like language?

Please, I need all of the help I can get.

--gazbo

PS. I can't add any more details now, as I have an irrepressible urge to learn to play the GNU/flute.

Troll 72 of 208 from the annals of the Troll Library .

NUKE THE RAGHEAD SAND NIGGERS

[Anonymous Coward]

Have you seen that bumper sticker that says, "No More Hiroshimas"?
I wish I had one that says, "You First. No More Pearl Harbors."

MOD PARENT UP!!!!!

If SECURE STORAGE is what you're after

[Anonymous Coward]

It's a safe bet no one's going to reach in there