Skip to main content

Security for Storage

GravityZone Security for Storage delivers real-time protection for leading file-sharing and network-storage systems. System and threat-detection algorithm upgrades happen automatically - without requiring any efforts from you or creating disruptions for end-users.

Important

The Security for Storage solution has been validated by the Nutanix Ready team on Nutanix Files 4.0.2.

Two or more GravityZone Security Servers Multi-Platform perform the role of ICAP server providing antimalware services to Network-Attached Storage (NAS) devices and file-sharing systems compliant with the Internet Content Adaptation Protocol (ICAP, as defined in RFC 3507).

When a user requests to open, read, write, or close a file from a laptop, workstation, mobile, or other device, the ICAP client (a NAS or file-sharing system) sends a scan request to Security Server and receives a verdict regarding the file. Depending on the result, the ICAP client allows access, denies access or deletes the file.

Note

This module is an add-on available with a separate license key.

Components

Security for Storage uses the following components:

  • GravityZone Virtual Appliance

  • Security Server Multi-Platform: for ICAP servers

Install and configure Security for Storage

To start using this feature, follow the steps below:

Testing out the feature

Check if the ICAP client is protected by the Security Server

To check if the ICAP client is protected by the Security Server, you must:

  1. Download a test file from eicar on the protected storage.

  2. Check the Notifications tab for the detected file.

    sva_cl_op_pt_icap_notifications.png

  3. Generate a Security Audit Report and check if the malware is reported.

    sva_cl_op_pt_icap_audit.png
Monitor the ICAP activity

Once you have installed the Security Server and configured them to use a policy with ICAP scanning enabled, you can monitor their activity in several places in GravityZoneControl Center:

  • In the Network section, locate the Security Server used as ICAP servers and click their names to view more information in the Protection tab of the endpoint details screen.

  • In the Reports section, generate a Security Audit or a Security Servers Status report.

  • In the Notifications area, look for the Storage Antimalware notification.

Depending on your configuration, the ICAP server can scan the following quantities of data per hour.

These values are obtained using a basic ICAP client and a specific workload involving multiple files under 100MB. Factors like implementation, machine hardware configuration, disk latency, network capacity, physical host capabilities, and workload characteristics can all impact the amount of data that can be scanned in an hour.

SVA CPUs

SVA RAM (GB)

GB/hour Throughput

Average Network Speed (Mbit/s)

2

2

80

370

4

4

150

390

8

4

280

550

Note

Due to the timeouts typically set by ICAP clients that happen usually around 30-60s, it's advisable to set a file size limit. Sending a large file over the network may exceed these limits. The ICAP protocol does not allow requesting data at specific offsets in a file, therefore the entire file will be sent for scanning.

In this section: