Strategies for Data Protection - Brocade

SAN SecuritySecuring Storage Data PlacementIn addition to securing storage data as it crosses the fabric betweeninitiator (server) and target (storage array), it may also be necessary tosecure storage data at rest. Safeguarding data at the storage systemhas two components. First, the application data must be written to itsspecified storage location in a storage array. The authorized relationship(binding) between a server application and its designated storagelocation ensures that an unauthorized server cannot inadvertently ordeliberately access the same storage data. Second, additional datasecurity can be provided by payload encryption as the data is written todisk or tape. Unauthorized access to or removal of disk drives or tapecartridges would thereby render the data unintelligible without theappropriate encryption keys.LUN MaskingLUN masking restricts access to storage resources by making visible toa server only those storage locations or logical units (LUNs) behind azoned storage port that a server is authorized to access. Both fabriczoning and LUN masking are needed to fully enforce access controls.Zoning defines server to storage port access control while LUN maskingdefines which storage LUNs behind the storage port are availableto the server and its applications. If a large storage array, for example,supports 10 LUNs, a server may see only 1 available LUN. The other 9have been masked from view and are typically assigned to differentservers.Strategies for Data Protection 31