ISO/IEC 27040

ISO/IEC 27040 is part of a growing family of International Standards published by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) in the area of security techniques; the standard is being developed by Subcommitee 27 (SC27) - IT Security techniques of the first Joint Technical Committee 1 (JTC 1) of the ISO/IEC. A major element of SC27's program of work includes International Standards for information security management systems (ISMS), often referred to as the 'ISO/IEC 27000-series'.

The full title of ISO/IEC 27040 is Information technology — Security techniques — Storage security.

Overview and introduction

The purpose of ISO/IEC 27040 is to provide security guidance for storage systems and ecosystems as well as for protection of data in these systems. It supports the general concepts specified in ISO/IEC 27001.

This International Standard is relevant to managers and staff concerned with information security risk management within an organization and, where appropriate, external parties supporting such activities. The objectives for this International Standard are to:

• help draw attention to the risks,
• assist organizations in better securing their data,
• provide a basis for auditing, designing and reviewing storage security controls.

It is emphasized that ISO/IEC 27040 provides further detailed implementation guidance on the storage security controls that are described at a basic standardized level in ISO/IEC 27002.

This International Standard is not a reference or normative document for regulatory and legislative security requirements. These important influences cannot be stated specifically in an international standard, since they vary by country.

History

Work commenced on ISO/IEC 27040 in the fall of 2010, following the SC27 meeting in Redmond, WA. The project was placed on the extended timeline, allowing up to 48 months to develop the standard rather than the normal 36 months.

Throughout the development of ISO/IEC 27040, organizations such as the Storage Networking Industry Association (SNIA) with its Storage Security Best Current Practices (BCPs), the Trusted Computing Group's (TCG) Storage Working Group with its work on self-encrypting drives, and INCITS' storage-oriented Technical Committees (T10, T11, and T13) provided important comments and contributions.

Development of the draft standard has included two Working Drafts (WD), two Committee Drafts (CD), a Draft International Standard (DIS), and a Final Draft International Standard (FDIS) cycles; the FDIS balloting cycle is expected to complete during the fall of 2014 with publication to follow shortly thereafter.

Structure of the Standard

The standard contains the following sections:

1. Scope
2. Normative references
3. Terms and definitions
4. Symbols and abbreviated terms
5. Overview and concepts (storage and storage security)
6. Supporting controls
7. Guidelines for the design and implementation of storage security
8. Annex A (normative) Media sanitization
9. Annex B (informative) Selecting appropriate storage security controls
10. Annex C (informative) Important security concepts
11. Bibliography
12. Index

It is worth noting that the bibliography is one of the more comprehensive lists of references on storage security. In addition, this is one of the few ISO/IEC standards that includes an extensive index.

Terms and Definitions

International Standards often serve as an authoritative source for important terminology and ISO/IEC 27040 is no exception. The following are a few key definitions worth noting:

storage security:

application of physical, technical and administrative controls to protect storage systems and infrastructure as well as the data stored within them

Note 1 to entry: Storage security is focused on protecting data (and its storage infrastructure) against unauthorized disclosure, modification or destruction while assuring its availability to authorized users.

Note 2 to entry: These controls may be preventive, detective, corrective, deterrent, recovery or compensatory in nature.

data breach:

compromise of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to protected data transmitted, stored or otherwise processed

Electronically Stored Information:

data or information of any kind and from any source, whose temporal existence is evidenced by being stored in or on any electronic medium

Note 1 to entry: Electronically Stored Information (ESI) includes traditional e-mail, memos, letters, spreadsheets, databases, office documents, presentations and other electronic formats commonly found on a computer. ESI also includes system, application and file-associated metadata (3.26) such as timestamps, revision history, file type, etc.

Note 2 to entry: Electronic medium can take the form of, but is not limited to, storage devices and storage elements.

secure multi-tenancy:

type of multi-tenancy that employs security controls to explicitly guard against data breaches and provides validation of these controls for proper governance

Note 1 to entry: Secure multi-tenancy exists when the risk profile of an individual tenant is no greater than it would be in a dedicated, single-tenant environment.

Note 2 to entry: In very secure environments even the identity of the tenants is kept secret.

Supporting Controls

This section provides the controls that support storage security technical architectures, their related technical controls, and other controls (technical and non-technical) that are applicable not just to storage. The materials in this section are further divided into:

• Direct Attached Storage (DAS)
• Storage networking (SAN and NAS)
• Storage management
• Block-based storage (Fibre Channel and IP)
• File-based storage (NFS, SMB/CIFS, pNFS)
• Object-based storage (cloud, OSD, CAS)
• Storage security services (sanitization, data confidentiality, and data reductions)

Design and Implementation of Storage Security

Despite the increased power of personal computers and departmental workstations, there continues to be a dependency on centralized data centers due to the need for data integration, data consistency, and data quality. With the enormous growth of critical data volumes, many organizations have adopted storage-centric architectures for their ICT infrastructure. Consequently, storage security plays an important role in securing this data, and in many instances, it serves as the last line of defense from both internal and external attack.

Designing and implementing storage security solutions requires adherence to core security design principles. In addition, the controls and guidance described in section 6 (Supporting Controls) have to be integrated into the design and implementation of storage security solutions to counter storage security threats. Data sensitivity, criticality, and value can also be an important consideration in designs. The materials in this section are further divided into:

• Storage security design principles (Defense in depth, Security domains, Design resilience, and Secure initialization)
• Data reliability, availability, and resilience (including Backups and replication as well as Disaster Recovery and Business Continuity)
• Data retention (Long-term and Short to medium-term retention)
• Data confidentiality and integrity
• Virtualization (Storage virtualization and Storage for virtualized systems)
• Design and implementation considerations (Encryption and key management issues, Align storage and policy, Compliance, Secure multi-tenancy, Secure autonomous data movement)

Media Sanitization

"Sanitization" is the technical term for assuring that data left on storage at the end of its useful life is rendered inaccessible to a given level of effort. Or to put it another way, sanitization is the process that assures an organization doesn't commit a data breach by repurposing, selling, or discarding storage devices.

Sanitization can take many forms depending on both the sensitivity of the information and the level of effort a likely adversary would invest in attempting to recover the information. Methods used in sanitization range from simple overwrites to destruction of the cryptographic keys for encrypted data (the technique is known as cryptographic erasure) to physical destruction of the storage media. This standard provides guidance to help organizations select the proper sanitization methods for their data.

The specific details on sanitization are provided in a series of tables in Annex A, which were based on NIST Special Publication 800-88 Revision 1 (draft). The tables were designed so that vendors can make specific references to them, based on the type of media, instead of using obsolete sources such as DoD 5220.22-M (from 1995).

Selecting appropriate Storage Security Controls

The developers of ISO/IEC 27040 did not intend that all of the guidance had to be implemented (i.e., all or nothing). Consequently, Annex B was created to help organizations select the appropriate controls based on either data sensitivity (high or low) or security priorities, based on confidentiality, integrity and availability. To support this selection, all of the storage security controls in ISO/IEC 27040 are listed in 13 different tables along with information that shows how each control is relevant from both data sensitivity and security prioritization perspectives.

It is worth noting that although Annex B is informative, it is very likely that auditors will use it as a basis for checklists when reviewing the security of storage systems and ecosystems.

Important security concepts

One of the challenges in developing ISO/IEC 27040 was that there were two distinct target audiences: 1) storage professionals and 2) security professionals. To help both communities, Annex C was populated with useful tutorial information for the following:

• Authentication
• Authorization and access control
• Self-Encrypting Drives (SED)
• Sanitization
• Logging
• N_Port_ID Virtualization (NPIV)
• Fibre Channel Security
• OASIS Key Management Interoperability Protocol (KMIP)