Strategies to protect SANs in branch offices in risky places

Question

A company has several remote branch offices located in relatively dangerous places, such as Iraq, and I'm looking into strategies to secure the SAN in the event of theft or looting. The data is commercially sensitive and contains intellectual property. Some of these offices are mobile, moving locations every couple of months.

Basically, the goals are:

1. Prevent data from the SAN falling into the hands of others
2. Prevent the destruction of data

Each site has:

• A VPN, providing access to a central data centre in the USA (over a satellite link, sometimes as low as 4MB/s)
• A local, highly-available ESXi cluster (note the vCentre server is located in a central data centre in Europe)
• Virtual SAN storage (using StorMagic)
• No local backups; backups are done remotely to a central data centre in Europe. The satellite links are often slow, and sites can sometimes be without access for several hours

At present, no data is encrypted - for this question, that's what I want to focus on.

Do you have any suggestions? Should we encrypt at the SAN level, the vSphere level, the OS level? How should keys be managed?

Answer 1

1 - Prevent data from the SAN falling into the hands of others

Full Disk Encryption (FDE) with large, secure passwords, unique for each server. If the SAN is stolen, all data is encrypted. Unique passwords limits the damage if some passwords leaks.

I would recommend FDE for everything (even OS files, public website data, everything), because it uses only one key for the entire computer, does not forces the user to classify the data as confidential or public. It's less problematic to protect something that could be public than publishing something secret.

2 - Prevent the destruction of data

Backups. That's the only way.

If you have any infrastructure (even more if on a place where physical security is not always granted), you must have offsite backups. And tested backups.

Data destruction can always occur, and mitigate the results is the only thing you can do. You cannot prevent the data destruction (intentional or accidental), but you can (and must) prevent irrecoverable data loss.