Shared Storage Admin Accounts and an Exposed 6 km Fiber Link
A hospital's SAN has two fabrics, 48 hosts, and three arrays. Zoning was built by different contractors: most zones are single-initiator/single-target, but one fabric still has broad zones that let all hosts see all array ports. Array and switch admin accounts are local and shared by five administrators, with the password rotated quarterly. Logs are not exported. There is no encryption at rest. A compliance audit found unencrypted SAN traffic on a 6 km dark fiber link to a satellite imaging center. HIPAA and internal policy require unique IDs, MFA for administrative access, and encryption in transit and at rest for ePHI. The budget can fund either array-based encryption or switch-based link encryption this year, not both.
1. Prioritize the remediation steps and justify the order.
Read the worked answer
Order by blast radius and audit evidence, not by purchase order.
- Remove permissive zoning first. An 'all hosts to all ports' zone lets any compromised host see every LUN, including ePHI. Convert to single-initiator/single-target zones and remove host-to-host paths. This is configuration, not budget.
- Kill shared admin accounts. Five admins using one local account defeats attribution and makes HIPAA audit logs useless. Create unique named accounts, integrate with AD/LDAP, require MFA for array and switch management, and log to SIEM.
- Encrypt the 6 km dark fiber link. That path leaves the building and is the most exposed transit segment. Switch-based ISL encryption protects it without rekeying arrays.
- Encrypt data at rest. This protects drives and backups that leave the data center for repair or disposal.
- Export logs and enable configuration change alerts.
Because the budget covers only one encryption project this year, do link encryption first if the fiber is the only offsite path; schedule array encryption next fiscal year and document the residual risk. If drives routinely leave for warranty repair, reverse that priority.
2. Redesign zoning and authentication for the 48-host SAN.
Read the worked answer
Zoning: inventory all 48 hosts and their HBA WWNs, then build single-initiator, single-target zones using device aliases; no zones containing two initiators. Separate zones for backup/tape targets and for replication ports. Disable unused switch ports, set port binding where supported, and use peer zoning only if the platform supports it and the security team accepts it. Keep a documented zoning map and review changes through change control.
Authentication: join arrays and switches to centralized AAA (RADIUS/TACACS+/AD), create role-based groups (storage admin, backup operator, auditor, read-only), enforce MFA for privileged access, and remove local emergency accounts except one sealed break-glass account with logging. Set session timeouts and command logging. Export audit logs to the SIEM and alert on zoning changes, LUN masking changes, and failed logins. Test that a departed admin's account is disabled within one hour. This addresses unique IDs, least privilege, and auditability without relying on quarterly password rotation of a shared account.
3. Choose between array-based encryption and switch-based link encryption and describe the key management requirements.
Read the worked answer
Choose based on the threat each control addresses. Array-based encryption protects data at rest if a drive or array is stolen, returned, or decommissioned; it does not protect data crossing the 6 km fiber. Switch-based link encryption protects the ISL but not a drive leaving the building. Since the audit specifically flagged the dark fiber and the budget allows one project, implement switch-based encryption on the ISL now, and document array encryption as a scheduled gap with compensating controls (secure drive shredding, chain-of-custody, locked cages).
If the array vendor includes encryption at no extra license cost, enable it as well; many arrays now do. For key management, use an external KMIP-compatible key server, not keys stored on the array, with separate backup of keys and dual control. Rotate keys on a defined schedule, test restore with keys before enabling on production LUNs, and ensure the DR array can reach a key server at the DR site. Encrypting without a recoverable key strategy creates an availability risk that is worse than the original finding.