A company has several remote branch offices located in relatively dangerous places, such as Iraq, and I'm looking into strategies to secure the SAN in the event of theft or looting. The data is commercially sensitive and contains intellectual property. Some of these offices are mobile, moving locations every couple of months.

Basically, the goals are:

  1. Prevent data from the SAN falling into the hands of others
  2. Prevent the destruction of data

Each site has:

  • A VPN, providing access to a central data centre in the USA (over a satellite link, sometimes as low as 4MB/s)
  • A local, highly-available ESXi cluster (note the vCentre server is located in a central data centre in Europe)
  • Virtual SAN storage (using StorMagic)
  • No local backups; backups are done remotely to a central data centre in Europe. The satellite links are often slow, and sites can sometimes be without access for several hours

At present, no data is encrypted - for this question, that's what I want to focus on.

Do you have any suggestions? Should we encrypt at the SAN level, the vSphere level, the OS level? How should keys be managed?

  • As asked, this is impossibly broad. You need to narrow down your strategies to specific threats. Lower the impact and likelihood of a threat materializing. Have you looked at military approaches to this?
    – schroeder
    Jan 7, 2020 at 14:03
  • The data contains both commercially sensitive information and intellectual property, so theft could have commercial and legal repercussions. The amount of sensitive data stored on-site has already been trimmed to the minimum, but as I'm sure you understand, it's not possible to work with only public data :) Jan 7, 2020 at 14:21
  • I know it may sound silly to you, but I work with orgs who want to "secure all the things!" without any regard for the negative impacts of a breach. To spend millions protecting something that has very low value (or is public), is fool-hardy. Some people focus on the process rather than the goal, so it needed to be raised. I get your situation, though.
    – schroeder
    Jan 7, 2020 at 14:40

1 Answer 1


1 - Prevent data from the SAN falling into the hands of others

Full Disk Encryption (FDE) with large, secure passwords, unique for each server. If the SAN is stolen, all data is encrypted. Unique passwords limits the damage if some passwords leaks.

I would recommend FDE for everything (even OS files, public website data, everything), because it uses only one key for the entire computer, does not forces the user to classify the data as confidential or public. It's less problematic to protect something that could be public than publishing something secret.

2 - Prevent the destruction of data

Backups. That's the only way.

If you have any infrastructure (even more if on a place where physical security is not always granted), you must have offsite backups. And tested backups.

Data destruction can always occur, and mitigate the results is the only thing you can do. You cannot prevent the data destruction (intentional or accidental), but you can (and must) prevent irrecoverable data loss.

  • What would you recommend for FDE? (I noticed that BitLocker doesn't support encrypting the boot partition on VMs). What about encryption at the SAN level instead? What about encryption at the hypervisor level? (vSphere supports this, in conjunction with a KMS) Jan 8, 2020 at 9:45
  • You don't need to encrypt the boot partition, OS will manage it, and there's nothing secret there anyway. Bitlocker on the OS partition is enough.
    – ThoriumBR
    Jan 8, 2020 at 12:31
  • That would presumably mean that a PIN/password needs to be manually entered for every VM as it boots? Jan 8, 2020 at 15:26
  • Yes, every time you reboot a VM, you need to enter the password. I know, it's not a pleasant thing to do, but if someone wants to steal the data, they must keep the server powered on.
    – ThoriumBR
    Jan 8, 2020 at 15:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .