STORAGE SYSTEMS: Tackling Security Breaches

There is a growing apprehension about information misuse on corporate Intranet setups. Solutions providers have to tread a fine line while implementing a storage system to ensure that only authorized personnel get access to relevant information, to avoid security breaches.

In an era when storage is an integral part of corporate networks, the security of organizational information has become a prime concern. This is especially due to the increasing dependence on accumulated information and the need to disseminate it, in the right fashion. 

Information is now accessible to employees, customers as well as business partners. And this, can happen from within the organization or externally. 

WHAT NETWORK STORAGE SYSTEMS OFFER

In legacy storage systems, data was stored in discrete data silos security, which was not much of a concern as compared to networked storage.

With it issues related to cost overheads due to over-provisioning of capacity in individual servers were eliminated. It also provides avenues for optimizing capacity utilization by mapping extra storage requirements across various servers, within the networked storage environments. 

HOW SAN WORKS

Even though networked storage increases complexities, it facilitates efficient storage management and helps in reduction of storage management costs to a great extent. Networking storage in storage area networks (SANs) has become popular because they directly support strategic corporate competitive goals. SANs also demonstrate a better RoI, scalability, availability and sharing of data between different application servers. 

Additionally, SANs help in the consolidation of server and storage resources without sacrificing high-availability practices. The amount of storage utilized between shared set of resources increases to 70% and better.

In a networked storage, multiple layers of security stand between the company´s valuable information and the outside world.

However, this may not be the case if a storage network is directly connected and extended over a public network such as the Internet. At such times, it is critical to protect the integrity (data between sender and receiver) and privacy (encrypted and compartmentalized) of the information.

SECURITY SYSTEMS REQUIREMENTS

Security solution providers must implement solutions that include as many security mechanisms as possible in the environment. It is best to remove complexities wherever possible, especially for untrained or inexperienced partners in security practices or procedures.

Partners must take care that any end-to-end security system, when implemented, follows a few basic steps before the requested data is accessed. Firstly, these systems should perform authentication because the identities of a sender and receiver has to be verified. Once this is done, all users must be authorized. 

Building upon these two steps is the process of auditing. An audit tracks activities of the authorized user and records it after he logs out. Integrity of data is the next step in the process. Digital signature techniques help in protecting data and management of traffic. Checksums verify that the data transferred by the sender wasn´t altered in transit or before arriving at the receiver´s location. 

Finally, security solution providers can implement Data Encryption Standard (DES) and Advanced Encryption Standard (AES) technologies from the National Institute of Standards and Technology
(NIST).

SECURITY IMPLEMENTATION COSTS

While implementing multiple levels of security, its cost certainly accrues correspondingly. The TCO must be calculated on the basis of how much it will cost to avoid proprietary data and information loss. Partners must offer clients a realistic measurement of expenses and determine the level of security to be implemented. 

Besides all these, the ease-of-use and management of data is a prime concern for companies while choosing a security solution. Organizations will not prefer to manage another add-on hardware box or software module. They will look out for easy to implement and low in support overhead security solutions. Partners must keep this in mind while adding devices and software in the data center environment. 

WHAT CUSTOMERS LOOK FOR 

The type of customers and their work environment are two important factors that determine the level of security systems to be implemented. Users may find it very complex to work in a highly secure environment. If it is a hindrance to their work, they will not support work prevention. Thus, partners have to strike a fine balance between implementing a security solution and accessing to information.

Understanding the various levels of network security is the key to implementing security
solutions. The channel will have to keep coming up with storage solutions as data storage is an
on-going concern rather than a point-in-time concern.

Sudhakar Rao is the Director Technical,
Hitachi Data Systems, India