[ Applies to ] StorageGuard 9.2 and later / All supported storage, backup, SAN and cloud systems / Windows and Linux deployments
StorageGuard is agentless and scales from a single data center to many sites. A few decisions made before you install save rework later: where StorageGuard runs, how it reaches each system, what accounts it uses, and what your security team needs to approve. This article walks you through them and ends with a checklist to work through before installation.
In this article
How StorageGuard works
- StorageGuard server. A dedicated server runs the application and its web interface, where you manage scans, policies, findings and reports.
- Database. A dedicated PostgreSQL (recommended) or Oracle database stores the collected configuration data and the analysis results.
- Collectors. Optional. A collector scans systems in a remote site or a segmented network and sends the data back to the server. The server includes one built-in collector, the Local Scan Server.
- Scanned systems. Storage arrays, SAN switches, backup systems, cloud accounts and hosts. StorageGuard is agentless: it signs in over HTTPS, SSH or WinRM and runs read-only commands and API calls. It collects configuration, never the data stored on the systems.
For a description of each component, see StorageGuard Deployment Components.
Decisions to make
| Decision | What to consider | Read |
|---|---|---|
| Server platform | Install on Windows with the installer, or on Linux with Docker. | |
| Server and database sizing | Size the server and the dedicated database for the number of systems you'll scan. | StorageGuard Installation Requirements |
| Collectors | Whether some systems are in remote sites or segmented networks, or your environment is large enough to spread scanning. | Decide whether you need collectors |
| Network paths | Users to the server, the server to scanned systems, collectors and the database, and the server to your mail server. | Network communication |
| Scan accounts | A read-only account on each system, with sudo where privileged commands are needed. Store passwords in StorageGuard, encrypted, or in CyberArk or HashiCorp Vault. | |
| Sites | Optional for most deployments, but collectors are assigned by site. Plan sites if you'll use collectors. | Sites |
| Security approval | What StorageGuard collects, how it protects credentials, and which ports it uses. | Prepare for your security review |
Planning checklist
Work through these before you install:
- You've read the release notes for the version you're installing.
- Your security team has reviewed and approved StorageGuard.
- The StorageGuard server is provisioned to the sizing requirements, on Windows or on Linux with Docker.
- A dedicated PostgreSQL or Oracle database is available.
- You know which networks need a collector, and a Windows or Linux machine is ready for each.
- Firewall rules are in place for the ports StorageGuard uses.
- Each system you'll scan has a read-only account, and the ports its scan requirements list are open.
- If you use CyberArk or HashiCorp Vault, the scan accounts are stored there.
- If you'll use collectors, you've decided on your sites.
[ Next step ]
Related articles
[ Still need help? ]
Our support team can help with connecting systems and scan setup. Submit a request
Comments
0 comments
Please sign in to leave a comment.