What it means
SAN zoning and LUN masking restrict which initiators can communicate with storage targets and which logical units each host may discover or use.
Why it matters
Shared storage must not rely on obscurity or host behavior; layered fabric and array controls reduce accidental and unauthorized access to block devices.
Practical focus
- Define the initiator-to-target and host-to-volume relationships in shared storage and the security outcome it must support
- Apply single-initiator zoning where appropriate, explicit LUN presentation, authenticated management, and change review through documented, reviewable configuration
- Verify fabric configuration, presented volumes, host identifiers, path state, and unauthorized discovery after changes and on a scheduled basis
- Plan for a zoning or masking error exposing a volume to the wrong host, including rollback, ownership, and escalation
Common mistakes
- Enabling a feature without defining what it should protect
- Relying on defaults or one-time validation
- Granting broad exceptions that erase the control boundary
- Treating a zoning or masking error exposing a volume to the wrong host as an operational surprise instead of a test case
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: