Cybertest

Are you certain your storage device is secure?  Be certain wth SNIA.

SNIA conducts conformance tests to ensure your devices are protected from such events as POODLE attacks.  These conformance tests are conducted to restrict the use of less secure methods of connection.  In order to be protected, your device must be using the Storage Management Initiative Specification (SMI-S) industry standard for storage management.

The SMI-S standard defines how a device (array, HBA, switch or tape library) is to be interfaced with by management software.  SMI-S incorporates SNIA's Transport Layer Security (TLS) Specification for Storage Systems standard into SMI-S.  SNIA's TLS standard is one of the most rigid standards for security that is available.

IMPORTANT:  Be sure to ask your storage vendor, or have your integrator ask you vendor, if they support the proper versions of SMI-S that check for security conformance.  Also be sure to have you network penetration test determine if port 5888 to storage devices is open.  It should not be.  Port 5889 is the secure port that should be used for managing the device as long as SMI-S is in use.

The SMI-S Conformance Test Program (CTP) test versions that support the testing of security are 1.5.0.1123 and 1.6.1.1123.  The list of vendors and their devices that have passed the SMI-S CTP test can be found here.

Get more information about SMI-S.

Get more information about TLS Specification for Storage Systems.

As always, you are welcome to contact SNIA at snia-ctp-admin@snia.org if you have any questions.