Security

Material on this page is intended solely for the purpose of content review by SNIA members. Tutorial material may be read and commented upon by any SNIA member, but may not be saved, printed, or otherwise copied, nor may it be shared with non-members of the SNIA. Tutorial managers are responsible for responding to all comments made during the open review period. No responses will be given to comments made outside the open review period.

Jump straight to an abstract:

The Abstracts

Self-Encrypting Drives
Michael Willett
Download

Data security is top of mind for most businesses trying to respond to the constant barrage of news highlighting data theft and security breaches. Combined with litigation risks, compliance issues and pending legislation, companies face a myriad of technology and products that all claim to protect data at rest. However, these current solutions either fail to deliver or force compromise. The disk drive industry has launched innovative, simple and powerful technology intended to secure data where it lives – in the disk drive. This tutorial will give storage users and managers a look at emerging drive-level encryption technology for laptops, PCs, and data centers that provides a more secure storage foundation.

Learning Objectives:

Understand the basics of storage self-encryption
Appreciate the standardization effort for storage self-encryption, with active participation across the entire storage industry
Be able to compare in detail self-encryption with other forms of storage encryption

How E-Discovery Will Impact Your Life as a Storage Professional
David Stevens
Download

Mention the term E-Discovery to a storage professional and watch their reaction. They may run away and hide. Storage Professionals today face the daunting task of being able to quickly know where every email, word document and database file lives and how to get it back in a hurry in the event of a catastrophe. With the recent update to the Federal Rules of Civil Procedure (FRCP) a storage professional now has even more pressure to potentially know the content inside those files.

Learning Objectives:

This session helps the storage professional understand the new Federal Rules of Civil Procedure (FRCP) that were updated December 1, 2006
We will also look at an e-discovery request from the perspective of a storage professional
Finally, we will provide some recommendations on how to prepare for an e-discovery request

ABCs of Encryption
Roger Cummings
Download

Public disclosures of data “indiscretions” have become regular enough and embarrassing enough that many organizations are exploring encryption options both to satisfy information protection requirements and to simply stay out of the headlines. Those who have ventured into this space quickly realize that there is no “magic crypto fairy dust” that will make the problems go completely away. However, with careful planning and judicious use of the right technologies, organizations can eliminate many of their exposures. This session focuses on the efforts required at the storage layer to both create a successful encryption strategy and effectively deploy products that address encryption of data at-rest as well as data in-flight. The session is based on an established step-by-step process that is defined in detail in a SNIA white paper.

Learning Objectives:

Understand where encryption can applied to the storage layer
Identify data at-rest encryption prerequisites and opportunities
Be able to create a process to support encryption that's appropriate to a specific enterprise

Introduction to Key Management for Secure Storage
Walt Hubis
Download

As secure storage becomes more pervasive throughout the enterprise, the focus quickly moves from implementing encrypting storage devices to establishing effective key management policies. Without the proper generation, distribution, storage, and recovery of key material, valuable data will be eventually compromised. Worse, without proper management of key information, data can be completely lost. This session explores the fundamental issues and technologies that impact key management for disk, tape, array, and other storage devices. Major issues associated symmetric encryption keys are presented, along with practical advice on effective key management issues and practices.

Learning Objectives:

Become familiar with basic cryptographic key terminology
Understand common cryptographic key threats, protection mechanisms, and implementations
Understand what key management methods are currently being used and the standards organizations addressing these methods

SNIA Storage Security Best Practices
Eric Hibbard
Download

With the increasing importance and emphasis on security in mind, the Storage Networking Industry Association (SNIA) had developed and published (see http://www.snia.org/forums/ssif/programs/best_practices/) a set of storage security best current practices (BCPs). This vendor neutral guidance has a broad scope, covering both storage systems and entire storage ecosystems. Specific elements include, but are not limited to, storage management, system configurations, protocols, compliance, encryption, key management, and long-term archive. This session provides an introduction to the BCPs as well as information that that will help organizations exploit the BCPs in their own environments.

General introduction to the SNIA storage security BCPs
Understand which storage security BCPs are considered critical
Practical tips on ways to utilize the storage security BCPs

Securing the Cloud – Using storage services without risking corporate data security
Russ Fellows
Download

Security has always been a critical aspect of IT storage. However, the proliferation of networking technologies and protocols, combined with the emergence of Cloud Storage has made security more important and difficult than ever. In this presentation, we will examine some of the technologies and standards that are available to solve these issues, and show how companies can utilize these technologies to design an architecture that is scalable, and secure. You will learn how to establish security practices that accommodate multiple networking technologies including FCoE, IB, iSCSI and FC networks. Securing data in both public and private Clouds is also covered, with an examination of the issues around securing Cloud and other storage services. This session will focus on the data-center requirements for implementing a successful encryption strategy that secures data both in-flight and at-rest. Issues such as when and where to encrypt data, products to use and the all-important key-management question are all addressed.

Attendees will gain an understanding of products and technologies delivering storage security and key-management
Gain an understanding of how Storage as a Service, Cloud Storage and emerging networking technologies will impact storage security