National foreword

This British Standard is the UK implementation of EN ISO/IEC 27040:2016. It is identical to ISO/IEC 27040:2015. It supersedes BS ISO/IEC 27040:2015 which is withdrawn.

The UK participation in its preparation was entrusted by Technical Committee IST/33, IT - Security techniques to Subcommittee IST/33/4, Security Controls and Services.

A list of organizations represented on this subcommittee can be obtained on request to its secretary.

This publication does not purport to include all the necessary provisions of a contract. Users are responsible for its correct application.

Compliance with a British Standard cannot confer immunity from legal obligations.

This British Standard was published under the authority of the Standards Policy and Strategy Committee on 31 January 2015.

Foreword

ISO (the International Organization for Standardization) and IEC (the International Electrotechnical Commission) form the specialized system for worldwide standardization. National bodies that are members of ISO or IEC participate in the development of International Standards through technical committees established by the respective organization to deal with particular fields of technical activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the work. In the field of information technology, ISO and IEC have established a joint technical committee, ISO/IEC JTC 1.

The procedures used to develop this document and those intended for its further maintenance are described in the ISO/IEC Directives, Part 1. In particular the different approval criteria needed for the different types of document should be noted. This document was drafted in accordance with the editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives).

Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent rights. Details of any patent rights identified during the development of the document will be in the Introduction and/or on the ISO list of patent declarations received (see www.iso.org/patents).

Any trade name used in this document is information given for the convenience of users and does not constitute an endorsement.

For an explanation on the meaning of ISO specific terms and expressions related to conformity assessment, as well as information about ISO’s adherence to the WTO principles in the Technical Barriers to Trade (TBT) see the following URL: Foreword - Supplementary information

The committee responsible for this document is ISO/IEC JTC 1, Information technology, SC 27, Security techniques.

Introduction

Many organizations face the challenge of implementing data protection and security measures to meet a wide range of requirements, including statutory and regulatory compliance. Too often the security associated with storage systems and infrastructure has been missed because of misconceptions and limited familiarity with the storage technology, or in the case of storage managers and administrators, a limited understanding of the inherent risks or basic security concepts. The net result of this situation is that digital assets are needlessly placed at risk of compromise due to data breaches, intentional corruption, being held hostage, or other malicious events.

Data storage has matured in an environment where security has been a secondary concern due to its historical reliance on isolated connectivity, specialized technologies, and the physical security of data centres. Even as storage connectivity evolved to use technologies such as storage protocols over Transmission Control Protocol/Internet Protocol (TCP/IP), few users took advantage of either the inherent security mechanisms or the recommended security measures.

This International Standard provides guidelines for storage security in an organization, supporting in particular the requirements of an Information Security Management System (ISMS) according to ISO/IEC 27001. This International Standard recommends the information security risk management approach as defined in ISO/IEC 27005. It is up to the organization to define their approach to risk management, depending for example on the scope of the ISMS, context of risk management, or industry sector. A number of existing methodologies can be used under the framework described in this International Standard to implement the requirements of an ISMS.

This International Standard is relevant to managers and staff concerned with information security risk management within an organization and, where appropriate, external parties supporting such activities.

The objectives for this International Standard are the following:

help draw attention to the risks;
assist organizations in better securing their data when stored;
provide a basis for auditing, designing, and reviewing storage security controls.

It is emphasized that ISO/IEC 27040 provides further detailed implementation guidance on the storage security controls that are described at a basic standardized level in ISO/IEC 27002.

It should be noted that this International Standard is not a reference or normative document for regulatory and legislative security requirements. Although it emphasizes the importance of these influences, it cannot state them specifically, since they are dependent on the country, the type of business, etc.

This European Standard was approved by CEN on 19 June 2016.

CEN and CENELEC members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions for giving this European Standard the status of a national standard without any alteration. Up-to-date lists and bibliographical references concerning such national standards may be obtained on application to the CEN-CENELEC Management Centre or to any CEN and CENELEC member.

This European Standard exists in three official versions (English, French, German). A version in any other language made by translation under the responsibility of a CEN and CENELEC member into its own language and notified to the CEN-CENELEC Management Centre has the same status as the official versions.

CEN and CENELEC members are the national standards bodies of Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, Former Yugoslav Republic of Macedonia, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, Switzerland, Turkey and United Kingdom.

European foreword

The text of ISO/IEC 27040:2015 has been prepared by Technical Committee ISO/IEC JTC 1 “Information technology” of the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) and has been taken over as EN ISO/IEC 27040:2016.

This European Standard shall be given the status of a national standard, either by publication of an identical text or by endorsement, at the latest by February 2017, and conflicting national standards shall be withdrawn at the latest by February 2017.

Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. CEN [and/or CENELEC] shall not be held responsible for identifying any or all such patent rights.

According to the CEN-CENELEC Internal Regulations, the national standards organizations of the following countries are bound to implement this European Standard: Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, Former Yugoslav Republic of Macedonia, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, Switzerland, Turkey and the United Kingdom.

Endorsement notice

The text of ISO/IEC 27040:2015 has been approved by CEN as EN ISO/IEC 27040:2016 without any modification.

1 Scope

This International Standard provides detailed technical guidance on how organizations can define an appropriate level of risk mitigation by employing a well-proven and consistent approach to the planning, design, documentation, and implementation of data storage security. Storage security applies to the protection (security) of information where it is stored and to the security of the information being transferred across the communication links associated with storage. Storage security includes the security of devices and media, the security of management activities related to the devices and media, the security of applications and services, and security relevant to end-users during the lifetime of devices and media and after end of use.

Storage security is relevant to anyone involved in owning, operating, or using data storagedevices, media, and networks. This includes senior managers, acquirers of storage product and service, and other non-technical managers or users, in addition to managers and administrators who have specific responsibilities for information security or storage security, storage operation, or who are responsible for an organization’s overall security program and security policy development. It is also relevant to anyone involved in the planning, design, and implementation of the architectural aspects of storage network security.

This International Standard provides an overview of storage security concepts and related definitions. It includes guidance on the threat, design, and control aspects associated with typical storage scenarios and storage technology areas. In addition, it provides references to other International Standards and technical reports that address existing practices and techniques that can be applied to storage security.

2 Normative references

3 Terms and definitions

4 Symbols and abbreviated terms

5 Overview and concepts

5.1 General

5.2 Storage concepts

5.3 Introduction to storage security

Storage security is concerned with the physical, technical and administrative controls as well as the preventive, detective and corrective controls associated with storage systems and infrastructure as outlined in 5.2. Storage security can also force the introduction of specialized technologies such as:

media sanitization;
virtualization security;
self-encrypting storagedevices (see C.3) like HDD, Solid State Drives (SSD), and Solid State Hard Drive (SSHD);
key management services;
data authenticity and integrity services;
data in motion protections (encryption and data reduction);
directory services and other user management systems.

To better understand the security issues and implications for storage, one should know both how and why the storage technologies are used. As a starting point, consider the following:

The storage systems can function as nodes within storage networks, which can be based on, but not limited to technologies like Transmission Control Protocol/Internet Protocol (TCP/IP), Fibre Channel (FC), Fibre Channel over Ethernet (FCoE), and InfiniBand. The potential threats can vary significantly based on the networking technology as well as the topologies used.
When stored, the data is typically represented and accessed as either block data or as files/objects; there are significant differences between these two types of storage methods. Likewise, the security measures associated with each can have radical differences, especially with access controls, encryption, and data integrity.
As part of normal storage operations, many storagedevice types have more internal media capability than is exposed through the interface. SSDs and SSHDs often are typically over provisioned, where data may be moved internally between physical media areas to improve write latencies. HDDs often contain spare areas where data may be moved internally between physical media areas when there is a temporary access problem. User data may remain on such areas even after the device is written through its interface. Such devices may not be cleared by overwrites through the interface.
Storage management is both an element of the storage infrastructure as well as an operation performed on many of the systems. It is common to have privileged users applying configuration changes, provisioning storage, tuning, monitoring, etc. this infrastructure. Some of the management can be performed remotely as well as involve third parties such as vendor support personnel.
Data availability and integrity are key factors in an organization’s storage architecture, so it is important for security to be complementary rather than a trade-off and that it not negate high-availability measures by introducing choke-points and additional single points of failure.
Many organizations implement elaborate data resiliency strategies, which are integral to their Disaster Recovery (DR) and Business Continuity (BC) plans. Security mechanisms like data at rest encryption have to be implemented carefully to ensure that resiliency strategies are not impacted.
Virtualization within storage can take many forms and be implemented at different points within the storage infrastructure. This virtualization can mask the physical details associated with the presentation of storage (e.g., a Logical Unit or filesystem to a server), mask the true capacity of a device, perform policy-driven autonomous data movement (like tiered storage), or completely abstract the storage infrastructure (like cloud computing storage). Balancing the security and virtualization so they can coexist requires careful planning and selection of the right technologies.
Data growth rates in some organizations are driving increased use of data storage technologies. As an alternative to acquiring additional storage, organizations are employing data reduction technologies such as compression and deduplication. However, these data reduction technologies can be impacted by data at rest encryption mechanisms, and they in turn, can introduce data integrity problems during DR and BC operations.
As part of the normal data protection strategy, many copies of data end up getting created (e.g., replicated between systems and sites, backups, snapshots, etc.). These copies need to be protected appropriately while they are in use, and then properly sanitized when their usefulness has ended.
Sensitive and high-value data often need to be protected when transmitted between systems, using mechanisms like the Internet Protocol Security (IPsec). IPsec can have detrimental impacts to the use of certain technologies like Network Address Translation (NAT), Intrusion Detection System (IDS), Intrusion Prevention System (IPS), or other systems that look deeper into network traffic frames. Whether to rely on IPsec or other in motion protection protocols can hinge on the trade-offs of potentially neutralizing the value of other technologies or where in the network it is to be deployed.
Many organizations are implementing data at rest encryption to protect sensitive and high-value data. The specific cryptographic mechanisms and the point of encryption are important factors in the actual data protection as well as meeting compliance requirements.
Successful use of encryption is often predicated on proper management of keying material throughout its lifecycle. This includes correct generation of keys, secure storage and transmittal of key material, replicating keys as part of the normal strategy to ensure availability of the data, and proper disposal of the keying material when it is no longer needed. The sensitivity and importance of the data to be protected may also factor into the key management approach.

Ensuring adequate confidentiality, integrity, and availability of data stored and accessed on current and emerging storage technologies requires a concerted effort within this layer of ICT. Many of these security efforts will focus on:

protecting storage management (operations and interfaces);
ensuring adequate credential and trust management;
protecting data backup and recovery resources;
data in motion protection;
data at rest protection;
data availability protection;
Disaster Recovery and Business Continuity support;
proper sanitization and disposal;
secure autonomous data movement;
secure multi-tenancy.

5.4 Storage security risks

6 Supporting controls

6.1 General

6.2 Direct Attached Storage (DAS)

6.3 Storage networking

6.4 Storage management

6.5 Block-based storage

6.6 File-based storage

6.7 Object-based storage

6.8 Storage security services

7 Guidelines for the design and implementation of storage security

7.1 General

7.2 Storage security design principles

7.3 Data reliability, availability, and resilience

7.4 Data retention

7.5 Data confidentiality and integrity

7.6 Virtualization

7.7 Design and implementation considerations

Bibliography

BS EN ISO/IEC 27040:2016

Information technology. Security techniques. Storage security

Current

Published:

31 Jan 2015