Two Primary Areas of Risk Exposure
In networked storage environments, data has two primary areas of risk exposure. Data in flight is exposed as it traverses the SAN infrastructure from source to destination. During transit, there is the risk that the data can be captured, copied, or redirected to unauthorized users. Data at rest is exposed as it is written to disk or tape. Disk drives can be removed from cabinets, or tape cartridges taken elsewhere, and the original data restored. These potential areas of vulnerability were generally ignored by vendors and customers alike, since it seemed unlikely that someone would be able to tap into a Fibre Channel SAN and wreck havoc.
A Fibre Channel analyzer, for example, only captures 1-2 seconds of data transport. That could, however, translate into hundreds of megabytes of customer data, bank account information, and PIN numbers. A seemingly innocent Fibre Channel trace of a backup operation taken by a third-party service technician and sent by email to a support organization could therefore pose a significant security concern.
Crypto techniques (authentication and data encryption) add an incremental level of security for data in flight and at rest, but cannot provide an absolute safeguard for storage. For data in flight, authentication and encryption can ensure that sniffing the SAN transport will not yield usable data. This is especially applicable to IP storage environments, where data may be traveling over untrusted local or wide area network segments.
Current encryption products can perform near wire-speed data encryption for gigabit networks, so there is no longer a severe performance penalty in providing in-flight security. For data at rest, new security products from NeoScale and other vendors provide payload encryption for data on Fibre Channel links just prior to writing to disk or tape. Anyone absconding with encrypted disk drives or tape cartridges would require enormous processing resources and time to attempt data recovery.