NIST SP 800-209 Security Guidelines for Storage Infrastructure ストレージインフラのセキュリティガイドライン

こんにちは、丸山満彦です。

NISTからSP 800-209 Security Guidelines for Storage Infrastructure ストレージインフラのセキュリティガイドラインが公表されていました。。。

● NIST - ITL

・2020.10.26 (publications) SP 800-209 Security Guidelines for Storage Infrastructure

・[PDF] SP 800-209

ストレージ技術は、

• メディア (Tape, HD, SSD...) （容量増加）
• アーキテクチャ (直接接続、ネットワーク内ストレージ配置、クラウドベースのストレージリソースアクセス) 

の2つの方向性で進化してきた。特にアーキテクチャの進化に伴い、管理の複雑さが増し、構成エラーやそれに伴うセキュリティ上の脅威が高まった。

ということで、SP 800-209では、ストレージ技術の進化、現在のセキュリティ上の脅威、およびその結果として生じるリスクの概要を説明し、脅威に対処するための包括的なセキュリティ勧告のセットを提供しているとのことです。

NISTは、情報技術（IT）の３つの基盤として、

1. コンピューティング（OSとホストのハードウェア）
2. ネットワーク
3. ストレージ

と考えているようですね。

このうち、コンピューティングとネットワークについては十分に議論されているが、データ侵害等の問題が注目されているにもかかわらずストレージ基盤についてのセキュリティガイドラインがなかったので、このガイドラインを作ったようですね。

したがって、このガイドラインはストレージ基盤についての包括的なセキュリティ対策の推奨事項が含まれているようです。また、具体的には、

• 物理的セキュリティ
• 認証と認可
• 変更管理
• 構成管理
• インシデン対応と復旧

など、IT基盤全体に共通するものだけでなく、ストレージ基盤に固有の領域である、

• データ保護
• 隔離
• 復元保証
• データ暗号化

などにも言及されているようですね。

---

Table of Contents	目次
Executive Summary	エグゼクティブサマリー
1 Introduction	1 はじめに
1.1 Scope	1.1 範囲
1.2 Target Audience	1.2 ターゲットオーディエンス
1.3 Relationship to Other NIST Guidance Documents	1.3 他の NIST ガイダンス文書との関係
1.4 Organization of this Document	1.4 本書の構成
2 Data Storage Technologies: Background	2 データストレージ技術：背景
2.1 Block Storage Service	2.1 ブロックストレージサービス
2.2 File Storage Service	2.2 ファイルストレージサービス
2.3 Object Storage Service	2.3 オブジェクトストレージサービス
2.4 Content-Addressable Storage (CAS) Service	2.4 CAS（Content-Addressable Storage）サービス
2.5 Higher-Level Data Access Service	2.5 高次データアクセスサービス
2.6 Software-Defined Storage	2.6 ソフトウェア定義ストレージ
2.7 Storage Virtualization	2.7 ストレージの仮想化
2.8 Storage for Virtualized Servers and Containers	2.8 仮想化サーバとコンテナのストレージ
2.9 Converged and Hyper-Converged Storage (Server-based SAN)	2.9 コンバージドストレージとハイパーコンバージドストレージ（サーバベースSAN）
2.10 Cloud-Based Storage System	2.10 クラウド型ストレージシステム
2.11 Storage and Data Management	2.11 ストレージとデータ管理
3 Threats, Risks, and Attack Surfaces	3 脅威、リスク、攻撃面
3.1 Threats	3.1 脅威
3.2 Risks to Storage Infrastructure	3.2 ストレージインフラのリスク
3.3 Attack Surfaces	3.3 攻撃面
4 Security Guidelines for Storage Deployments	4 ストレージ導入のためのセキュリティガイドライン
4.1 Physical Storage Security	4.1 物理ストレージのセキュリティ
4.2 Data Protection	4.2 データ保護
4.3 Authentication and Data Access Control	4.3 認証とデータアクセス制御
4.4 Audit Logging	4.4 監査ロギング
4.5 Preparation for Data Incident Response and Cyber Recovery	4.5 データインシデント対応とサイバーリカバリーへの備え
4.6 Guidelines for Network Configuration	4.6 ネットワーク構成のガイドライン
4.7 Isolation	4.7 アイソレーション
4.8 Restoration Assurance	4.8 復旧保証
4.9 Encryption	4.9 暗号化
4.10 Administrative Access	4.10 管理者アクセス
4.11 Configuration Management	4.11 構成管理
4.12 Training	4.12 トレーニング
5 Summary and Conclusions	5 まとめと結論

---

■ 参考

● まるちゃんの情報セキュリティ気まぐれ日記

・2020.07.22 NIST SP 800-209 (Draft) Security Guidelines for Storage Infrastructure

Abstract

Storage technology, just like its computing and networking counterparts, has evolved from traditional storage service types, such as block, file, and object. Specifically, the evolution has taken two directions: one along the path of increasing storage media capacity (e.g., tape, Hard Disk Drives, solid-state drives (SSD)) and the other along the architectural front, starting from direct-attached storage (DAS) to the placement of storage resources in networks accessed through various interfaces and protocols to cloud-based storage resource access, which provides a software-based abstraction over all forms of background storage technologies. Accompanying the architectural evolution is the increase in management complexity, which subsequently increases the probability of configuration errors and associated security threats. This document provides an overview of the evolution of the storage technology landscape, current security threats, and the resultant risks. The main focus of this document is to provide a comprehensive set of security recommendations that will address the threats. The recommendations span not only security management areas that are common to an information technology (IT) infrastructure (e.g., physical security, authentication and authorization, change management, configuration control, and incident response and recovery) but also those specific to storage infrastructure (e.g., data protection, isolation, restoration assurance, and encryption).

---

Executive Summary

Storage, computing, and networking form the three fundamental building blocks of an information technology infrastructure. Just like computing and network technologies, storage technology has also evolved over the years. Higher capacity storage media and storage system architecture are the two fronts on which storage technology has evolved. The developments on the second front have enabled storage services to support many new and evolving computing use cases but have also introduced storage management complexity and many security challenges.

Just like computing and networking, the current landscape of storage infrastructure consists of a mixture of legacy and advanced systems. With this in mind, this document provides an overview of the storage technology landscape, including traditional storage services (e.g., block, file, and object storage), storage virtualization, storage architectures designed for virtualized server environments, and storage resources hosted in the cloud. Descriptions of various threats to the storage resources are also included, as well as an analysis of the risks to storage infrastructure and the impacts of these threats.

The primary purpose of this document is to provide a comprehensive set of security recommendations for the current landscape of the storage infrastructure. The security focus areas span those that are common to the entire IT infrastructure, such as physical security, authentication and authorization, change management, configuration control, incident response, and recovery. Within these areas, security controls that are specific to storage technologies, such as network-attached storage (NAS) and storage area networks (SAN), are also covered. In addition, security recommendations specific to storage technologies are provided for the following areas of operation in the storage infrastructure:

• Data protection
• Isolation
• Restoration assurance
• Encryption

---

Table of Contents

Executive Summary
1 Introduction
1.1 Scope
1.2 Target Audience
1.3 Relationship to Other NIST Guidance Documents
1.4 Organization of this Document

2 Data Storage Technologies: Background
2.1 Block Storage Service
 2.1.1 Storage Area Network (SAN)
 2.1.2 Other forms of Networked Block Storage
2.2 File Storage Service
2.3 Object Storage Service
2.4 Content-Addressable Storage (CAS) Service
2.5 Higher-Level Data Access Service
2.6 Software-Defined Storage
2.7 Storage Virtualization
2.8 Storage for Virtualized Servers and Containers
2.9 Converged and Hyper-Converged Storage (Server-based SAN)
2.10 Cloud-Based Storage System
2.11 Storage and Data Management
 2.11.1 Storage Resource Configuration and Resource Management
 2.11.2 Data Classification or Categorization
 2.11.3 Data Sanitization
 2.11.4 Data Retention
 2.11.5 Data Protection
 2.11.6 Data Reduction

3 Threats, Risks, and Attack Surfaces
3.1 Threats
 3.1.1 Credential Theft or Compromise
 3.1.2 Cracking Encryption
 3.1.3 Infection of Malware and Ransomware
 3.1.4 Backdoors and Unpatched Vulnerabilities
 3.1.5 Privilege Escalation
 3.1.6 Human Error and Deliberate Misconfiguration
 3.1.7 Physical Theft of Storage Media
 3.1.8 Network Eavesdropping
 3.1.9 Insecure Images, Software and Firmware
3.2 Risks to Storage Infrastructure
 3.2.1 Data Breach and Data Exposure
 3.2.2 Unauthorized Data Alteration and Addition
 3.2.3 Data Corruption
 3.2.4 Compromising Backups
 3.2.5 Malicious Data Obfuscation and Encryption
 3.2.6 Data Unavailability and Denial of Service
 3.2.7 Tampering of Storage-Related Log and Audit Data
 3.2.8 Compromising Storage OS or Binaries, Firmware and Images
 3.2.9 Mapping of Threats to Risks
3.3 Attack Surfaces
 3.3.1 Physical Access
 3.3.2 Access to Storage Operating System
 3.3.3 Access to Management Hosts
 3.3.4 Management APIs, Management Software, and In-Band Management
 3.3.5 Storage Clients
 3.3.6 Storage Network (Tap Into, Alter to Gain Access)
 3.3.7 Compute Environment of Key Individuals
 3.3.8 Electrical Network and other Utilities

4 Security Guidelines for Storage Deployments
4.1 Physical Storage Security
4.2 Data Protection
 4.2.1 Data Backup and Recovery, and Archiving
 4.2.2 Replication and Mirroring
 4.2.3 Point-in-Time Copies
 4.2.4 Continuous Data Protection
4.3 Authentication and Data Access Control
 4.3.1 Authentication Recommendations
 4.3.2 Password Recommendations
 4.3.3 Account Management Recommendations
 4.3.4 Privilege and Session Management Recommendations
 4.3.5 SAN-Specific Recommendations
 4.3.6 File and Object Access Recommendations
4.4 Audit Logging
4.5 Preparation for Data Incident Response and Cyber Recovery
4.6 Guidelines for Network Configuration
 4.6.1 FC SAN and NVMEoF
 4.6.2 IP Storage Networking
 4.6.3 Protocols
4.7 Isolation
4.8 Restoration Assurance
4.9 Encryption
4.10 Administrative Access
4.11 Configuration Management
4.12 Training

5 Summary and Conclusions

References

Appendix A: Acronyms

---