SYS.1.8 Storage Solutions

The IT components of storage solutions MUST be installed in closed rooms. Access to these rooms MUST be restricted to authorised persons. In addition, a secure power supply MUST be ensured. Manufacturer recommendations on ambient temperature and humidity MUST be observed.

Prior to production use of a storage solution, it MUST be ensured that all the software components and firmware in use are up to date. Afterwards, a secure basic configuration MUST be established.

Unused interfaces of the storage system MUST be disabled. The files for the default configuration, the basic configuration performed, and the current configuration SHOULD be stored in a secure and redundant manner.

All administration and management access to storage systems MUST be restricted. It MUST be ensured that it is not possible to access administration interfaces from untrustworthy networks.

Protocols that are considered secure SHOULD be used. If insecure protocols are nonetheless utilised, a separate administration network MUST be used (see NET.1.1 Network Architecture and Design).

Based on an organisation's general security policy, a specific policy SHOULD be drawn up for storage solutions. This policy SHOULD transparently describe specifications as to how storage solutions may be planned, administered, installed, configured, and operated securely.

The policy SHOULD be known to all administrators in charge of storage solutions and be integral to their work. If the policy is changed or deviations from its specifications are allowed, this SHOULD be coordinated with the CISO and documented. It SHOULD be checked regularly whether the policy is still being properly implemented. It SHOULD be updated as required. The results SHOULD be appropriately documented.

Before storage solutions are implemented in an organisation, a requirements analysis SHOULD be carried out. The requirements analysis SHOULD consider, among other things, the topics of performance and capacity. Based on the requirements identified, a detailed plan for storage solutions SHOULD then be drawn up. The following items SHOULD be taken into account:

• selection of manufacturers and suppliers
• decision for or against central administration systems (management systems)
• planning of the network connection
• planning of the infrastructure
• integration into existing processes

The technical fundamentals of different storage solutions SHOULD be examined in detail. The impact of these technical principles on an organisation's potential use of the solutions SHOULD be examined. The options and limits of the different storage system types SHOULD be illustrated in a transparent manner for the persons in charge in the organisation. The criteria for choosing a storage solution SHOULD be documented in a transparent manner. The decision regarding the selection of a storage solution SHOULD also be documented in a transparent manner.

Based on the specified requirements an organisation's storage solution needs to meet, an appropriate supplier SHOULD be selected. The selection criteria and the decision in favour of a supplier SHOULD be documented in a transparent manner. Furthermore, maintenance and repair aspects SHOULD be documented in writing in service level agreements (SLAs). The SLAs SHOULD be unambiguous and quantifiable. The exact scheduled end of the contract with the supplier SHOULD be established in writing.

An operating manual SHOULD be drawn up. It SHOULD document all the rules, requirements, and settings for operating storage solutions. The operating manual SHOULD be updated at regular intervals.

Storage systems SHOULD be monitored in terms of the availability of internal applications, system load, and critical events. Furthermore, fixed maintenance windows in which changes may be implemented SHOULD be defined for storage solutions. In particular, firmware or operating system updates to storage systems or the network components of a storage solution SHOULD only be performed within a maintenance window.

Storage solutions SHOULD be monitored. All collected data (messages) SHOULD be checked, in particular to see if the specifications of the respective operating manual are being followed.

Essential messages SHOULD be highlighted using message filters. Individual components of storage solutions and the respective overall systems SHOULD be managed in a centralised manner.

An SAN SHOULD be segmented. A concept SHOULD be drawn up that assigns SAN resources to the respective servers. To this end, a decision SHOULD be taken as to which segmentation should be used in each implementation (e.g. FC SANs or iSCSI storage networks) based on the security requirements at hand and the administration effort required. The current resource allocation SHOULD be easily and clearly identifiable with the help of the administration tools. Furthermore, the current zoning configuration SHOULD be documented. The documentation SHOULD also be available in case of emergency.

An organisation's requirements regarding the multi-client capability of a storage solution SHOULD be defined and documented in a transparent manner. The storage solutions used SHOULD meet these documented requirements.

In block storage environments, LUN masking SHOULD be used in order to separate clients. In file service environments, it SHOULD be possible to use virtual file servers. Here, every client SHOULD be assigned its own file service.

When using IP or iSCSI, clients SHOULD be separated via segmentation within the network. If fibre channel is being used, VSANs and soft zoning SHOULD be used for segmentation purposes.

In multi-client-capable storage systems, it SHOULD be ensured that the logical unit numbers (LUNs) assigned to a certain client are deleted.

All storage system settings SHOULD be documented. The documentation SHOULD include the technical and organisational specifications in question, as well as any specific configurations of an organisation's storage systems.

If the documentation of system settings includes confidential information, this information SHOULD be protected against unauthorised access. The documentation SHOULD be regularly reviewed. It SHOULD always be up to date.

All storage systems used SHOULD be audited at regular intervals. A corresponding process SHOULD be established. It SHOULD be specified what security reports are to be drawn up at regular intervals and what they are to contain. Furthermore, it SHOULD also be specified how deviations from specifications must be handled and how often and to what extent audits are to be performed.

If entire storage solutions or individual components thereof are no longer required, any data they contain SHOULD be transferred to other storage solutions. A transitional phase SHOULD be scheduled for this. Afterwards, all payload and configuration data SHOULD be securely deleted. Any references to the decommissioned storage solution SHOULD be removed from any relevant documents.

A business continuity plan for the storage solution deployed SHOULD be drawn up. The business continuity plan SHOULD include an accurate description of the steps to take in certain emergency situations. Instructions in the form of safeguards and commands that support error analysis and error correction SHOULD be included, as well. In order to remedy errors, appropriate tools SHOULD be used.

Regular drills and tests SHOULD be conducted using the business continuity plan. The data generated during the drills and tests and after an actual emergency SHOULD be deleted securely afterwards.

Clients SHOULD be assigned storage resources from different storage pools. In this process, a storage medium SHOULD only be assigned to one pool at a time. The logical hard disks (LUNs) generated from such a pool SHOULD only be assigned to a single client.

A highly available SAN solution SHOULD be used. The replication mechanisms used SHOULD meet the availability requirements of the organisation in question regarding its storage solution. The configuration of the storage solution SHOULD also meet the availability requirements. Furthermore, there SHOULD be a test and consolidation system.

All data stored in storage solutions SHOULD be encrypted. The levels at which encryption is to be performed SHOULD be defined (regarding data in motion and data at rest). In this process, it SHOULD be ensured that the encryption along the transport channel is also relevant for replications and backup traffic.

In order to ensure the integrity of the SAN fabric, protocols with additional security features SHOULD be used. The security features of the following protocols SHOULD be taken into consideration and corresponding configurations SHOULD be used:

• Diffie Hellman Challenge Handshake Authentication Protocol (DH-CHAP)
• Fibre Channel Authentication Protocol (FCAP)
• Fibre Channel Password Authentication Protocol (FCPAP)

In SAN environments, data SHOULD be deleted by overwriting the related storage segments of a LUN several times.

In order to segment SANs, hard zoning SHOULD be used.