Security Basics mailing list archives
RE: SAN Vulnerabilities
From: "Hahn, Ron" <ron.hahn () fmr com>
Date: Fri, 17 Dec 2010 18:51:53 -0000
Mike, At the risk of stating the obvious.. I do not believe it is considered "best practice" to mix highly confidential and public (facing) information on the same storage partition/device. As a former IT practitioner in the public healthcare arena, I would have never considered storing patient data on ANY server that was accessible to the public. In fact, many public agencies I've worked with have IS policies explicitly banning this practice. I would recommend your web admins study a paper or two on information security and the protection of information assets. Just because its "convenient" to store their data on your SAN doesn't mean it's a good practice. I presume they are security conscious and will draw the same conclusion. R -----Original Message----- From: listbounce () securityfocus com [mailto:listbounce () securityfocus com] On Behalf Of mjd Sent: 16 December 2010 19:23 To: security-basics () securityfocus com Subject: SAN Vulnerabilities We are evaluating a proposal wherein our Web Server Admins would like to use our internal SAN to host data for our external websites. Our external websites are on our outfacing DMZ which means they could be subject to all sorts of attack. Our internal SAN hosts some very sensitive health care data so I'm reluctant to allow this since it puts our most protected data physically very close to our most vulnerable segment. They have given me assurance that they have locked down the SAN to the point wherein one server accessing cannot access any other disk unless it is explicitly mounted. I do not have heavy experience with SANS, but based on their explanation, the SAN switch can be likened to a firewall in that it blocks any communication not explicitly allowed. When drawing this out on a board, it just doesn't look right. We're physically connecting servers in our External DMZ to our SAN which hosts very sensitive data. Any advice on this situation? Are we overreacting to this and should we trust in the security boundaries created by the SAN switch/controller? Are there vulnerabilities out there that allow an attacker to take control of the whole SAN? Thanks in advance! mjd ------------------------------------------------------------------------ Securing Apache Web Server with thawte Digital Certificate In this guide we examine the importance of Apache-SSL and who needs an SSL certificate. We look at how SSL works, how it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates. http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1 ------------------------------------------------------------------------ ------------------------------------------------------------------------ Securing Apache Web Server with thawte Digital Certificate In this guide we examine the importance of Apache-SSL and who needs an SSL certificate. We look at how SSL works, how it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates. http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1 ------------------------------------------------------------------------
Current thread:
- SAN Vulnerabilities mjd (Dec 17)
- RE: SAN Vulnerabilities Dan Lynch (Dec 17)
- Re: SAN Vulnerabilities William Reyor (Dec 17)
- RE: SAN Vulnerabilities Dan Lynch (Dec 17)
- Re: SAN Vulnerabilities William Reyor (Dec 17)
- RE: SAN Vulnerabilities Hahn, Ron (Dec 17)
- <Possible follow-ups>
- Re: SAN Vulnerabilities mjd (Dec 28)
- RE: SAN Vulnerabilities Dan Lynch (Dec 28)
- RE: SAN Vulnerabilities Dan Lynch (Dec 17)