User manual QUANTUM STORAGECARE GUARDIAN SECURITY WHITE PAPER

[. . . ] W H I T E PA P E R StorageCareTM Guardian Security StorageCareTM Guardian Security Notice This White Paper may contain proprietary information protected by copyright. Information in this White Paper is subject to change without notice and does not represent a commitment on the part of Quantum. Although using sources deemed to be reliable, Quantum assumes no liability for any inaccuracies that may be contained in this White Paper. Quantum makes no commitment to update or keep current this information in this White Paper, and reserves the right to make changes to or discontinue this White Paper and/or products without notice. [. . . ] As long as the server designated to act as the Guardian agent can communicate with the Quantum devices and open an outbound connection to the Internet, StorageCare Guardian will provide the security necessary to protect your information assets. 4 StorageCareTM Guardian Security Data Security One of the most common concerns customers raise regarding StorageCare Guardian is the security of the data stored on the Quantum device. The good news is, StorageCare Guardian does not impact the backup process, data, or other IT processes in general in any way. A key design element of StorageCare Guardian was that only the web management interface of the Quantum device would be used to collect the device data. SCSI, Fibre Channel or iSCSI) communication from the StorageCare Guardian agent software to the Quantum device. This solution has several key benefits in terms of data security ­ not only can we ensure to our customers that StorageCare Guardian will never conflict with backup software in any way, but we also can say with confidence that we have no access to the data stored on the Quantum device!There are no actions that can be taken via StorageCare Guardian that would enable your data to be read, or overwritten. In fact, by default only programmatic (pre-scripted, software-controlled) access is possible to the device; no human access is available to Quantum support personnel without direct customer intervention. we cannot reboot your library or take it off-line without your approval) but also Quantum. Everything that Quantum support personnel need to determine the health of the Quantum device at the customer site is available within the StorageCare Guardian back-end applications. These applications show a representation of the device, and allow support personnel to view status and configuration, review log files, etc. Should the need arise for Quantum support personnel to gain real-time access to the device, the customer can, at their discretion, enable access by support personnel to the web and/or telnet management interfaces of the Quantum device. When the need for access has been completed, it can be turned off as easily as it was enabled. You may also be wondering exactly what data is collected from the Quantum device. For the most part, only a predefined set of data elements that has been designed specifically for each device is collected from the device. Only information relating to the status and configuration of the device is transferred from the agent to Quantum. For instance, although the agent software must know the TCP/IP address for each of the Quantum device(s) in other to communicate with them, these addresses are not transferred to Quantum. Most of the data elements are state values (such as a DX system state of "Running" or a PX720 power supply status of "OK") or actual analog values such as power supply voltages, fan speeds and temperature readings. This more dynamic information is collected by the agent every 5 minutes. Other more static information such as the configuration of the device, firmware revisions, log files etc. Access Control As stated several times, Quantum's StorageCare Guardian was designed from the ground up with security in mind. Since we cannot actually log into the device, we cannot do things that could negatively impact the operation of the device, such as placing the device off-line, shutting it down or changing its configuration. Of course, if you feel it is appropriate at any time to allow Quantum support personnel to access the web or telnet management interface of your devices, you can enable these options on the Policy Manager page of the Agent Configuration Utility. [. . . ] The certification document will be made available to Quantum customers on request. Enterprise Server Security The same emphasis on security used in developing the StorageCare Guardian agent is also evident in the design of the back-end application infrastructure that resides at Quantum. While the StorageCare Guardian Console allows Quantum to provide better levels of service to our customers than ever before, it is important that these applications and the data they access are kept secure from unauthorized access. One critical element of the security of StorageCare Guardian's Enterprise systems is the design of the network. [. . . ]