Balancing Convenience, Redundancy, and Data Security in a NAS-driven Environment

31 01 2012
As both enterprise and home users seek convenient methods for storing growing amounts of data, and since modern iterations of both environments (almost always in the former, increasingly in the latter) include networking hardware, the popularity of Network-Attached Storage (NAS) devices has increased steadily over the past few years.  One source even claims the need for increased storage is best modeled by an exponential function.[1]  The key underpinnings of NAS proliferation, in a technical sense, are: further miniaturization of computing into form factors like micro, and even pico ITX[2], low and decreasing cost of mass storage drives, and the aforementioned availability of networks, even if, as may be the case with many home users, the network is as simple as a single 4-port switch, cable modem, and a PC.  NAS devices may be as simple as a single hard drive in an enclosure, no doubt an evolution from the first generations of external hard drive enclosures that reached wide popularity when USB 2.0 interfaces entered the market and allowed for reasonable (i.e.: “IDE-like”) rates of access.  NAS appliances are also available in larger and more complex configurations, such as the popular ReadyNAS line.[3]  With the physical package around data stores being relatively small and not generally involving constrained entry/use through a host OS, these devices might also appear to be “concentrated” targets of interest: a small item to steal compared to a desktop, and likely few or no passwords that would inhibit access to the data.  In some cases, they may be more lucrative targets than laptops if the purpose of the theft is to acquire information rather than the street value of a serially-tracked laptop.  This possibility begs the question, then, of what security mechanisms are available to protect the data on the device.
Self-encrypting hard-drives[4] are the preferred solution of federal government IA professionals as they offer a very high degree of protection in the event that an individual drive is stolen and that the attacker attempts to exploit the information stored on the drive.  Realistically, though, most vendors provide these with Serially-Attached SCSI (SAS) interfaces to target the enterprise market in which they are most in demand, and the average consumer NAS instead uses the more affordable SATA family of drive interfaces.  One solution is to create a TrueCrypt volume on the drive and mount the drive on a client system[5].  This creates two new challenges, however, one is performance-related, and the second relates to convenience.  With respect to performance, additional network overhead is unavoidable, but the principal performance hit to mitigate is decryption on the client machine.  The AES New Instructions found on some Intel chips can ameliorate the condition[6], and programs like TrueCrypt are able to utilize these hardware enhancements.
The convenience problem, and one the author has yet to solve effectively, is that the mounting of the encrypted volume, though located on a network store, has the decidedly frustrating side-effect of making access to the data a single-user experience.  How is this relevant?  Suppose you want to take advantage of a more complex NAS with integrated RAID and to synchronize your documents folder between your desktop, laptop, and any other computer onto which you might want to mirror the records.  The task is relatively simple to accomplish in recent versions of Windows.  Simply move the target location to a folder on the NAS and the OS will invoke the Sync Framework to move the files and make an “offline cache” copy, thus allowing for availability when disconnected or in the event of total NAS failure.  Synchronization occurs when you repeat the same move on a subsequent computer, and now changes reflect across both machines, and data lives on the NAS.  This maneuver emphasizes convenience, but is not possible inside a TrueCrypt volume.  Solutions for the “data at rest” problem in an environment of NAS proliferation (where self-encrypting drives are a limited, niche, and sometimes rather expensive solution), unfortunately, do not abound.  As your customers use more and more of these devices, consider the security risk that they pose with respect to being miniaturized containers of exploitable data.
_________________
2.  VIA Pico-ITX Mainboard Form Factor, http://www.via.com.tw/en/initiatives/spearhead/pico-itx/.
5.  TrueCrypt, http://www.truecrypt.org/.
Advertisements