{"id":5616,"date":"2023-06-16T15:47:21","date_gmt":"2023-06-16T19:47:21","guid":{"rendered":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/?p=5616"},"modified":"2023-08-11T10:40:58","modified_gmt":"2023-08-11T14:40:58","slug":"how-to-demonstrate-storage-backup-compliance-a-practical-guide","status":"publish","type":"post","link":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/how-to-demonstrate-storage-backup-compliance-a-practical-guide\/","title":{"rendered":"How To Demonstrate Storage & Backup Compliance: A Practical Guide"},"content":{"rendered":"

\"How<\/p>\n

Solutions Review\u2019s Premium Content Series is a collection of contributed articles written by industry experts in enterprise software categories. In this feature, Continuity Software<\/a> CTO Doron Pinhas and Veeam<\/a>‘s Eric Ellenberg offer tips on how to demonstrate data storage and backup compliance<\/a><\/span>.<\/strong><\/i><\/p>\n

Compliance to industry standards and regulatory mandates can absorb a huge amount of time. Organizations need to verify they comply with the different requirements of security frameworks and regulations such as CIS, NIST, PCI DSS, ISO, and others.<\/p>\n

In addition, many of these standards require organizations to verify that they are carrying out their fiduciary responsibilities concerning Common Vulnerabilities & Exposures (CVEs).<\/p>\n

The big problem is time.<\/p>\n

Storage & Backup Compliance is Time Consuming <\/strong><\/h4>\n

Some organizations spend countless hours manually preparing for compliance-related activities such as a PCI audit. Once the preparations are complete, even more time is absorbed in writing reports that demonstrate compliance\u2014and this is only the beginning of an ongoing process.<\/p>\n

According to NIST document SP 800-209 Security Guidelines For Storage Infrastructure<\/strong><\/span><\/a>, organizations are required to: \u201cperiodically and proactively assess configuration compliance to storage security policy\u201d. This includes the following 3 steps:<\/p>\n

Historically, these have been weak areas within organizations. The reasons are not difficult to comprehend\u2014the scope of compliance for storage and backup systems is immense.<\/p>\n

Many of the tools used to scan for vulnerabilities and security misconfigurations do a poor job in identifying storage and backup risks. In fact, they may cause the organization to falsely claim compliance when numerous security threats remain. The reason for this is that compliance often requires specific configurations for systems at all levels of your stack\u2014not just the guest operating system that hosts your applications\u2014working in concert to fulfill the policy\u2019s objective. This includes your storage and backup systems.<\/p>\n

Let\u2019s dive a little deeper on this and take a look at 6 steps to verify storage & backup compliance.<\/p>\n

\t\t\t

<\/a><\/p>\n<\/div>\n\t\t<\/div><\/div><\/span><\/p>\n

Storage, Backup & Compliance<\/strong><\/h2>\n

Demonstrating Storage & Backup Compliance \u2013 in 6 Steps<\/strong><\/h3>\n

System software<\/strong><\/h4>\n

Storage and backup systems suffer from CVEs like any other software, yet many organizations are either unaware that they exist, or have been lulled into a false sense of security that all critical CVEs have been addressed. The plain fact is that storage and backup operating systems are often riddled with vulnerabilities that can enable threat actors to gain unauthorized access, elevate permissions, and run arbitrary code. As well as being present within storage and backup systems, vulnerabilities may also be found in underlying components and modules, including embedded switches, controllers, boards, drivers, firmware, and other components.<\/p>\n

Unfortunately, most vulnerability scanners simply fail to assess storage and backup systems. They miss these critical CVEs and misconfigurations.<\/p>\n

SAN Zoning and Masking<\/strong><\/h4>\n

A large portion of Enterprise Block Storage is implemented using dedicated, non-IP Storage Area Networking (SAN). To allow hosts to access block storage devices (often referred to as \u201cLUNs\u201d), these networks need to be configured to support \u201cZones\u201d (somewhat similar to Ethernet VLANs) that pool together hosts and storage devices that can communicate with each other, and \u201cMasking\u201d (somewhat similar to IP ACLs) that further control which block devices can effectively be accessed at various points along the network path.\u00a0 Network Zoning and Masking mistakes are more common than many people realize. LUNs may have been left accessible to unintended hosts. Replicated copies and snapshots, too, may not have been properly secured. If that is the case, a hacker may be able to mount sensitive data to unauthorized clients.<\/p>\n

Audit Logging Misconfigurations<\/strong><\/h4>\n

Many backup systems are not configured sufficiently for audit logging. This manifests in ways such as missing audit log content, audit logs not relayed to central syslog servers, or logging settings that are tweakable by hackers to relay logs to unapproved hosts. These errors make it more difficult for the organization to detect brute force attacks and anomalous behavior patterns. They also impede forensic investigation and can curtail recovery efforts.<\/p>\n

Default Accounts and Passwords<\/h4>\n

A surprising number of storage systems still include default administrative usernames and passwords. These factory settings can easily be exploited to cause serious damage. Compliance efforts must carefully look over the different storage subsystems and respective user accounts to ensure access security policies are properly enforced.<\/p>\n

Control Over Administrative Access<\/strong><\/h4>\n

Configuration drift and oversights result in more user accounts with administrative access than required. An excessive number of administrator accounts increases the attack vectors that can be exploited by malicious actors. Furthermore, storage management components including Command Line and API interfaces often do not follow a least privilege design (aimed at making them accessible only by a minimal number of administrative accounts using an authentication system that complies with security and audit policies). This leaves many storage and backup systems open for data manipulation, theft, and destruction.<\/p>\n

Backup Isolation and Immutability<\/strong><\/h4>\n

Various standards require that backup data shall be kept in an isolated, inaccessible environment that does not overlap with the production network.<\/p>\n

These are just a few of the many security considerations and risks present in any storage and backup system.<\/p>\n

Fines and Penalties Galore<\/strong><\/h3>\n

Organizations that fail in any of the activities required to demonstrate compliance are subject to heavy fines and penalties. These days, when it comes to regulatory compliance, there are more eyes on backups than ever:<\/p>\n