Storage security is a specialty area of security that is concerned with securing data storage systems and ecosystems and the data that resides on these systems. Introduction According to the Storage Networking Industry Association (SNIA), storage security represents the convergence of the storage, networking, and security disciplines, technologies, and methodologies for the purpose of protecting and securing digital assets. Historically, the focus has been on both the vendor aspects of making storage product more secure and the consumer aspects associated with using storage products in secure ways. The SNIA Dictionary defines storage security as: Technical controls, which may include integrity, confidentiality and availability controls, that protect storage resources and data from unauthorized users and uses. ISO/IEC 27040 provides the following more comprehensive definition for storage security: application of physical, technical and administrative controls to protect storage systems and infrastructure as well as the data stored within them Note 1 to entry: Storage security is focused on protecting data (and its storage infrastructure) against unauthorized disclosure, modification or destruction while assuring its availability to authorized users. Note 2 to entry: These controls may be preventive, detective, corrective, deterrent, recovery or compensatory in nature. In 2021, Gartner introduced a new category, entitled ‘Cyberstorage’. As Gartner explains in the report, “Cyberstorage solutions deliver active technologies to identify, protect, detect, respond and recover from ransomware attacks on unstructured data storage solutions. I&O leaders must evaluate cyberstorage solutions as a new defense mechanism to protect their most critical data.” Principles of Security Storage Integrity: Stored data cannot be changed. Confidentiality: Only authorized users will have access to the data locally or through network. Availability: Manage and minimize the risk of inaccessibility due to deliberate destructions or accidents such as natural disaster, mechanical and power failures. Relevant standards and specifications Applying security to storage systems and ecosystems requires one to have a good working knowledge of an assortment of standards and specifications, including, but not limited to: ISO Guide 73:2009, Risk management — Vocabulary ISO 7498-2:1989, Information technology — Open Systems Interconnection — Basic Reference Model — Part 2: Security Architecture ISO 16609:2004, Banking — Requirements for message authentication using symmetric techniques ISO/PAS 22399:2007, Societal security — Guideline for incident preparedness and operational continuity management ISO/IEC 10116:2006, Information technology — Security techniques — Modes of operation for an n-bit block cipher ISO/TR 10255:2009, Document management applications — Optical disk storage technology, management and standards ISO/TR 18492:2005,