Ontap Tools Security

[alexandremendes]

I'm studying ONTAP tools and would like to better understand your perspective on the tool. I think the value it adds to administration is fantastic. But I'm also concerned about the risks if an attacker gains access to vCenter and can also directly damage the storage, such as deleting datastores, Snapmirrors, etc.

1) Is this risk worth the tradeoff for management agility?

2)How do you significantly reduce these risks? 

3) Does it work well with Multi-Admin Approvals?

[ChanceBingen · Accepted solution]

Hello, Alexandre!

Allow to address your questions one at a time.

1. Is the risk worth it? I think so, if you take the proper precautions outlined below.

2. For risk mitigation, there are several things you can do.

  a. You can limit access to just one SVM, and dedicate an SVM to just that purpose. This SVM could also use tenant capacity management to limit the storage consumption.

  b. You can lock down your vCenter users with the built-in vCenter user roles so that only very select users have the rights to delete datastores.

  c. You can use multi-factor authentication in vCenter to ensure your users are who they say they are.

  d. If you want to lock down ONTAP tools so that it can't ever delete volumes, you could use an ONTAP RBAC user lacking delete permissions when you onboard the storage to be managed.

Unfortunately, it doesn't currently support MAV. However, we have been talking about it internally. If you would like us to prioritize that feature, please let your account team (or partner) know so they can log a formal request.