Network Computing is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them. Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Scared Stupid: Page 2 of 3

The bottom line is, corporate data "at rest" that is, the point at which it's physically located on SANs, NAS, or direct-attached storage – has always been at risk. Tapes get lost, or stolen, or corrupted all the time. Would it be a good idea to encrypt this data, or certain data that is particularly sensitive? Sure.

But that's not enough for some people, who say the storage network itself also needs to be secured. Vendors touting storage security products argue that as both SANs and NAS grow beyond the boundaries of the data center, there are many more entry points to the key data stores than there were in the past – and each entry point produces a risk. But how big a risk, though? This isn't clear.

The concept of spoofing Fibre Channel-based world wide names (WWNs) in order to gain entry into a specific zone within a SAN isn't new, and it doesn't appear to be an issue. We couldn't find a single example of a SAN that had been hacked through WWN spoofing. There's bound to have been a couple. But once again, how big a risk is this really?

We need more information. Probably the only thing a storage admin can do at this point is ask vendors pushing this gear for examples of situations where storage networks have been hacked in the past. Then go talk to those people.

One thing's for sure with the hacker community, however: Challenge them a little, and you really turn them on.