Security Through Maturity: A Brief on Securing iSCSI Networks

Internet SCSI (iSCSI) can provide a number of advantages in enterprise storage area network (SAN) infrastructures—offering similar scalability, availability, and manageability as Fibre Channel in a cost-effective way, and enabling IT administrators to work with standard, familiar Ethernet components rather than specialized Fibre Channel equipment. iSCSI-capable Dell™ EqualLogic™ PS Series iSCSI SAN arrays, Dell PowerVault™ storage systems, and Dell/EMC storage systems can provide a simplified, scalable way to implement iSCSI SANs.The underlying technologies—the iSCSI protocol, Ethernet, and TCP/IP transport—help provide a well-known, mature, and cost-effective security infrastructure for iSCSI SANs. Key areas of security that effective iSCSI security strategies must address include data-at-rest (DAR) and data-in-flight (DIF) security; authentication, authorization, and data coherence; and defenses against passive, active, and operational attacks. Key best practices for securing iSCSI SANs include isolating the iSCSI domain, consolidating and securing management portals, disabling unused switch and router features, using access control lists for authorization, using Challenge Handshake Authentication Protocol (CHAP) and IP Security (IPsec) when appropriate, and defining a practical and secure key management strategy.Strong security does not necessarily mean expensive security. By taking advantage of the maturity of Ethernet and TCP/IP technologies that serve as the basis for iSCSI networking and following key iSCSI best practices, administrators can cost-effectively implement robust, secure iSCSI SANs as part of a comprehensive enterprise security strategy.