Network Computing is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them. Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Market Analysis: Storage Security: Page 6 of 11

iSCSI

• iSCSI switches: These are prone to all the vulnerabilities you're used to in IP. For example, an unauthorized user who gains administrative access can turn off VLANs (virtual LANs) and security. This is more of an issue with iSCSI than with FC because iSCSI uses off-the-shelf IP switches that don't have specialized storage security built in.

• iSCSI storage arrays: These can be more vulnerable to attack than FC storage arrays, for no other reason than that any machine on the IP network can see them. If there's a route between a given host and an IP storage box, there's a direct attack vector. ISCSI storage arrays suffer from the same physical access problems that affect FC storage. And in an iSCSI network, more security information is on the array, so gaining administrative access is more of a threat than in FC.

As we mentioned, most readers are worried about the security of their hosts and the applications running on them. The bad news is that once an attacker has access to a host on the storage network--be it Fibre Channel or iSCSI--he or she has access to all the data the host can see. Luckily, many of the products we looked at in "Securely Stowed" limit access rights by LUN, to limit what each host can see. Database encryption tools offer the added security of knowing your data is not accessible to any users except the ones that certain applications run as.

This is not a cure-all, but it does mean that an attacker taking over a box does not necessarily have access to all the data the box can "see." Decru offers an add-on application that lets admins limit which applications can run on a host, and what storage--down to the individual file level--each application can see. This is useful to keep an attacker from using applications like SQL*Net to access data in your database, even if the intruder has compromised the login of a database user.