HP StorageWorks 4000/6000/8000 - Enterprise Virtual Arrays, Reference Manual

Page: 406 / 456

• Data encryption —Invokes mechanisms that act in response to characteristics of the data, not in
response to a threat.
• Data separation —Provides separate paths for data or processing. The level of security for data
separation depends on the trust level associated with the system. Data separation ensures
nl
confidentiality by preventing data from reaching unauthorized users.
• Traffic separation —Adds meaningless random information and hides network-layer addresses.
Traffic separation ensures confidentiality by making it difficult to determine data characteristics,
such as frequency and traffic-flow destinations.
Data integrity
Data integrity prevents unauthorized modification or destruction of data and ensures nonrepudiation
and authenticity. Recording all changes to data enables the detection and notification of unauthorized
modifications.
Data integrity has two types of data:
• Single-unit data —Applied to a single piece of data
• Data stream —Applied to all PDUs
Data availability
Data availability ensures reliable access to data and information services for authorized users in the
SAN. You must protect your data from attacks, unauthorized use, and routine failures.
Nonrepudiation
Nonrepudiation ensures that all parties in a transaction are authenticated and verifies that they
participated in the transaction. Storage technologies are tied closely with data and are often the last
line of defense against attacks.
Security validation
Security validation establishes a secure audit trail across your organization. The audit trail serves as
proof of compliance for internal and external audits with real-time alerts. Validation is accomplished
using encryption, key management, and identity management, which creates an integrated compliance
solution across the organization.
To ensure compliance, every process you use must be repeatable, have demonstrated control points
(with documented responsible personnel), and include a tamper-proof audit tracking system.
Storage security best practices
To simplify storage security, the SNIA SSIF has developed the following security elements:
• Storage system security —Secures embedded operating systems and applications. Integrates with
IT and security infrastructure, such as external authentication services, centralized logging, and
firewalls.
• SRM —Securely provisions, monitors, tunes, reallocates, and controls storage resources to ensure
storage and retrieval of data.
• Data in-flight —Protects the confidentiality, integrity, and availability of data as it is transferred
across the SAN, LAN, or WAN. This may also include traffic management.
• Data at-rest —Protects the confidentiality, integrity, and availability of data stored on servers,
storage arrays, NAS appliances, tape libraries, and other media. The measures required depend
on the type of risk you are managing.
Storage security 406