Paul Suhler

Storage developers need to understand that the algorithms and protocols used for data protection are in the midst of significant changes. This is driven by increases in the size of storage devices, the complexity of large data storage systems, discoveries of weaknesses, and improvements in attacks on encryption. Storage devices are seeing changes in block encryption algorithms and in implementations of those algorithms. Post-quantum cryptographic (PQC) algorithms will improve resistance to attacks using quantum computers, and a new timeline is in effect for adoption of those algorithms. Various protocols are being updated to use the new algorithms and to manage the transition to PQC.

Paul Suhler

Principal Engineer, SSD Standards -- Security in Storage Working Group Chair

KIOXIA -- IEEE

The IEEE Security In Storage Work Group (SISWG) produces standards that many storage developers, storage vendors, and storage system operators care about, including: a) A family of standards on sanitization: the IEEE 2883 family b) A family of standards on encryption methods for storage components: the IEEE 1619 family c) A standard on Discovery, Authentication, and Authentication in Host Attachments of Storage Devices: the IEEE 1667 specification IEEE has a different work group (IEEE P3172) focusing on post-quantum cryptography, but when they are done, a family method that recommends new quantum encryption for various storage types (e.g., block, stream) may be appropriate for SISWG’s IEEE 1619 family. IEEE has a different work group focusing on Zero Trust Security (ZTS, IEEE P2887), however an application of those principles for storage devices and systems is also within the purview of the IEEE SISWG.

Paul Suhler

Principal Engineer, SSD Standards -- Security in Storage Working Group Chair

KIOXIA -- IEEE

Operators of data storage systems are legally obligated to protect customer data, and can be subject to significant penalties. This presentation will explore existing and upcoming standards to show the best practices for sanitizing customer data. These standards will include IEEE 2883-2022 and ISO/IEC 27040,and will describe current work on new standards.

The audience for this presentation includes developers and users of data storage systems, as well as developers of software utilizing those systems.

Paul Suhler

Principal Engineer, SSD Standards -- Security in Storage Working Group Chair

KIOXIA -- IEEE

The IEEE Security In Storage Work Group (SISWG) produces standards used by many storage developers, storage vendors, and storage system operators. New and ongoing work includes:
* Improving security of the XTS-AES encryption algorithm used by self-encrypting storage devices.
* Guiding users in sanitizing their storage devices.
* Guiding users in sanitizing large-scale virtual and cloud storage systems.
* Coordinating with other standards organizations, such as NIST and SNIA, to improve the coherence of the standards ecosystem.

Paul Suhler

Principal Engineer, SSD Standards -- Security in Storage Working Group Chair

KIOXIA -- IEEE

Post-quantum cryptographic (PQC) algorithms are intended to resist attacks on data and communications security by quantum computers. A variety of organizations have been defining PQC algorithms and how they are used to protect data storage. This talk will describe new and existing standards, as well as requirements for data storage products to comply with these standards in the near future.

Paul Suhler

Principal Engineer, SSD Standards -- Security in Storage Working Group Chair

KIOXIA -- IEEE