Data is an important asset for the University and there are policies and procedures in place to protect it. Grant providers may also have requirements regarding data storage and its retention.
Generally speaking, when choosing where or how to store your data you need to consider disaster recovery and business continuity as well as confidentiality, integrity and availability.
This document lays out the considerations when choosing a Network Attached Storage (NAS) device for data storage and when they will be permitted to be connected to the University/Clinical School network.
NAS devices often have an important role in research. These include being used for temporary data storage (e.g. scratch space) or holding places for data prior to backup.
However, appropriate hardware should be used in these instances. Consumer-grade NAS devices are strongly discouraged because:
They aren’t resilient – knock one over and likely the data is lost
They aren’t usually in a server room so subject to theft, overheating in summer, vulnerable to power surges
When situated in labs, there is a risk of exposure to chemicals or other potentially damaging consumables
They are often put on the same network as end user computers so can be easily compromised when another computer on that network is infected with a virus or malware exploit
They are rarely kept up to date, or subject to exploits (see https://www.engadget.com/western-digital-my-cloud-os-3-vulnerability-212839292.html for interesting example)
Essentially NAS devices are servers with lots of disk space and they need to be adequately secured, be kept up to date and otherwise meet the University’s various policies, such as:
Data owners must ensure that their data is classified according to https://help.uis.cam.ac.uk/service/security/data-sec-classes and located in appropriate data storage for that classification
The Systems Management policy applies to NAS devices: https://help.uis.cam.ac.uk/policies/systems-management-policy
And NAS devices must be operated in accordance to the Acceptable Use policy: https://help.uis.cam.ac.uk/policies/acceptable-use-policy
The Recovery Task Force has determined that NAS devices can be used when the following conditions are met:
IFS is performance not sufficient (read/write performance or network latency)
Needs mixed NFS/SMB
Scratch space or temporary data that is held on a NAS and quickly moved to another location (provided it is not level 3 data)
NAS is staging data from an instrument device prior to being moved to a central storage system such as RCS, RDS or IFS (e.g. HPC)
Physical proximity or direct connection to an instrument is necessary
If you previously had a NAS device connected to the network but it does not meet the above criteria, you should consider the many central University data storage services available. It is anticipated that many of the situations in which NAS devices were used IFS would be suitable. If your budget does not stretch to central services speak with CSCS or your Business and Operations Manager to discover what options may be available. The University have agreed to underwrite IFS costs for a period to allow grant applications to catch up with spending requirements. Options are currently being explored for research data.
Institutional File Store (IFS) - https://help.uis.cam.ac.uk/service/cloud-services/institutional-file-store-service-ifs
Research File Share (RFS) - https://www.hpc.cam.ac.uk/research-file-share
Research Data Store (RDS) - https://www.hpc.cam.ac.uk/research-data-store
Research Cold Store - (RCS) https://www.hpc.cam.ac.uk/research-cold-store
To opt to move your data to one of the above central services please fill out this Microsoft Form: https://forms.office.com/Pages/ResponsePage.aspx?id=RQSlSfq9eUut41R7TzmG6eI5ps7YxvhOpLs9ngrUbvRUMUlZQzc3U0FMMkxWRVU3RFY5WFlWRjFXQi4u . Ensure you indicate at the bottom of the form which service you think will be most suitable. CSCS will review the form and get back to you to organise the movement of your data.
If your NAS device meets any of the suitability points above, fill in this form to request that it be reconnected to the network - Microsoft Forms. Your response will be assessed and then prioritised and assured before connection to the network.
If a NAS device needs to remain on the network, it should be put on a private VLAN so that it is segregated from all other devices. NAS devices require dedicated resources to function properly, fit for purpose and kept up-to-date. Such resources are out of the scope for most IT teams.
To remain on the network, a NAS device should meet the following criteria:
Business-grade hardware is ideal e.g. redundant disks RAID and be rack mountable
Network connection is to a private VLAN with the following characteristics:
Connected directly to the firewall
No access to other devices or systems unless specifically enabled by IP address
Access to other devices or systems limited to instruments, scanning PC’s or storage systems such as IFS.
Limited or no internet access (limited access may be required for some to keep software/firmware updated) but otherwise unavailable
No remote access available (via VPN or other methods)
Suitable location – a NAS device will ideally be placed in a rack in a managed server room; if not possible
Room it is in should have restricted access
It should be on a stable surface
There should be climate control
Each device requires a nominated owner(s)
Hardware is PAT tested
Hardware should have power protection (minimum surge protection, ideally UPS)
Device can be scanned to audit that the NAS operating system is patched and checked for vulnerabilities
Will need to be assured following an agreed process to ensure it is safe for the network
Up-to-date and supported software (firmware)
Enable any malware or virus protection on the NAS or ensure the device accessing it has external on-access scanning of data enabled