RE: Question about shared storage arrays

[Javier Zayas <javier_zayas () cuc claremont edu>]

Melissa,

I actually have had some experience with this, and I also used to resell
such technology. The short of it is, as long as you ensure that LUN Masking
is being done and no other hosts are connecting your disks/file systems to
your machine, you will be perfectly fine. In a Unix environment, you can
setup HA systems to share the same LUNs. In a Windows environment, LUN
masking becomes vitally important as Windows by default tries to take over
every disk it sees at bootup. This becomes even more dangerous in a mixed
Unix/Windows environment. If you have any specific questions, please don't
be afraid to ask, you can even email them direct and then summarize for the
list later.

Javier Zayas
System Administrator
x73143
-----Original Message-----
From: mcgillim () cis uab edu [mailto:mcgillim () cis uab edu] 
Sent: Tuesday, March 30, 2004 7:32 AM
To: security-basics () securityfocus com
Subject: Question about shared storage arrays

Hello,
 I am currently charged with finding a storage solution for our company's
collection of databases. One option that has been presented to me is to
share a storage array with a company that provides other solutions for us.
We would have our own set of disks in the array. My question is, has anyone
here done this, or does anyone have any sort of knowledge of the security
implications of this measure. (What are my risk factors? Can other people
usng the array get to my data and if so how easy is it? etc....) I am
currently looking for answers online, but someone with some real experience
with this would benefit my cause greatly.

Thanks in advance!
Melissa McGillis
(For those watchdogs on the list, I don't work for UAB, this is just the
email I use for my mailing lists.)

--------------------------------------------------------------------
mail2web - Check your email from the web at
http://mail2web.com/ .



---------------------------------------------------------------------------
Ethical Hacking at the InfoSec Institute. Mention this ad and get $545 off 
any course! All of our class sizes are guaranteed to be 10 students or less 
to facilitate one-on-one interaction with one of our expert instructors. 
Attend a course taught by an expert instructor with years of in-the-field 
pen testing experience in our state of the art hacking lab. Master the
skills 
of an Ethical Hacker to better assess the security of your organization. 
Visit us at: 
http://www.infosecinstitute.com/courses/ethical_hacking_training.html
----------------------------------------------------------------------------

---------------------------------------------------------------------------
Ethical Hacking at the InfoSec Institute. Mention this ad and get $545 off 
any course! All of our class sizes are guaranteed to be 10 students or less 
to facilitate one-on-one interaction with one of our expert instructors. 
Attend a course taught by an expert instructor with years of in-the-field 
pen testing experience in our state of the art hacking lab. Master the skills 
of an Ethical Hacker to better assess the security of your organization. 
Visit us at: 
http://www.infosecinstitute.com/courses/ethical_hacking_training.html
----------------------------------------------------------------------------