Security, Access Control, and Compliance
Identity and access
Prism Central RBAC maps AD or LDAP users and groups to roles, so use least privilege. Files uses AD for SMB identities and export rules for NFS. Objects uses access keys and bucket policies. Volumes uses IQN allowlists and CHAP. Data-at-rest encryption can use software encryption or self-encrypting drives. In transit, Objects uses TLS, SMB can use signing and encryption, and iSCSI can use CHAP for login authentication.
Compliance controls
- Use File Analytics and Prism audit logs for access evidence.
- Enforce retention, versioning, or object lock where the service supports it.
- Rotate access keys and avoid embedding secrets in applications.
- Disable anonymous bucket access unless explicitly required.
- Restrict NFS exports and use root squash where appropriate.
- Use CHAP and IQN allowlists for iSCSI, and separate management traffic.
Worked example
An auditor asks who deleted a file from an SMB share. File Analytics can provide file-level audit records if auditing was enabled. Prism audit logs record administrative actions, not individual SMB file deletes. The distinction matters because enabling audit after an incident does not reconstruct past file activity.
Traps
Prism audit logs are not file-level audit logs. A bucket policy allow does not override an explicit deny. CHAP authenticates the iSCSI login but does not encrypt data in transit. An NFS export to a broad subnet is a common compliance finding.
Key points
- Prism Central RBAC uses AD or LDAP identities and roles.
- Files uses AD for SMB and export rules for NFS.
- Objects uses access keys, bucket policies, and TLS.
- Volumes uses IQN allowlists and optional CHAP.
- File Analytics and Prism audit logs serve different evidence needs.