Microsoft VP Sounds Off on SAN Security

SANs can't advance until they get more secure, according to the executive in charge of storage software at Microsoft Corp. (Nasdaq: MSFT).

"SANs are not secure," says Charles Stevens, corporate VP of Microsoft's Enterprise Storage Division, in an interview with Byte and Switch today. "You can get a password and get on... Protecting security and identity on a SAN is key to making SANs more widespread and ubiquitous."

Stevens's sentiments are hardly new. Thanks in part to some high-profile break-ins related to storage, SAN security has moved to the forefront of storage networking issues, with a bevy of hardware and software solutions offered to tackle the problem from various aspects (see SAN Security and Startups Focus on Secret SANs).

Microsoft's focus has been on extending the Radius (Remote Authentication Dial-In User Service) security it has in its Windows Server 2003 software into Windows Storage Server 2003, Microsoft's server operating system designed to consolidate and manage storage for file and print servers (see Microsoft Raises NAS Roof).

Stevens says Microsoft is still working with Brocade Communications Systems Inc. (Nasdaq: BRCD), Cisco Systems Inc. (Nasdaq: CSCO), McData Corp. (Nasdaq: MCDTA), and QLogic Corp. (Nasdaq: QLGC), among others, to tie their switch interfaces into Radius-based security in the Windows Server 2003.The goal is to link the SAN switch's operating system with Microsoft's server directory and Radius capabilities, which in turn are tied in with the server's directory. The result will be a series of barriers to entry on the SAN and the ability to qualify access according to the user's identification.

The products aren't ready yet, but Stevens says they're a priority for Microsoft and its partners in 2004. There is also more work being done to integrate Radius with other security protocols and extend its capabilities, most notably within the Internet Engineering Task Force (IETF).

Stevens says security is important not just in SANs but in NAS and other lower-end storage networks as well. In particular, where small and medium-sized businesses consolidate storage for file and print servers, it will be vital to have a common Windows-based security program.

Stay tuned for more from our interview with Stevens.

Mary Jander, Site Editor, Byte and Switch