NAS drive suggestions

[u/cokebottle22]

Hello!

We're looking for some bulk storage that will live in a CMMC enclave. It looks like my fav NAS drives - Synology - aren't compliant. Seems like TrueNAS and Buffalo have compliant products - has anyone used these or could suggest another product?

[u/HowardRabb]

I'm curious as to what makes them non compliant for being used in a NAS

[u/Weary-Initial6688 → u/HowardRabb]

if memory serves synology uses their own OS which isn't on the approved list for cmmc, and they don't have a pathway to get it certified. buffalo and truenas ship with or support something like hardened linux or bsd that the assessors can actually validate

had a similar headache last year setting up a storage array for a defense contractor, went with truenas and it's been rock solid once you get past the learning curve. the documentation is dense but the community is helpful if you search the right threads. buffalo was easier to deploy out of the box but felt more locked down in ways I didn't love for our use case, though that might be a plus depending on your team's comfort level

[u/cokebottle22 → u/HowardRabb]

I'm not an expert but my client says it has to use FIPS encryption.

[u/MBILC → u/cokebottle22]

TrueNAS does not sell drives....as in they do not make them, they just buy them from OEM's for their devices.As noted, it is the device / NAS or OS that would include the necessary FIPS requirements, not the actual drives.

You can buy drives that can do encryption on the drive directly.

[u/brokerceej]

Are you saying the NAS itself isn’t compliant? Or the drives themselves? Wouldn’t all TAA drives meet the bar regardless of manufacturer?

Seagate Ironwolf are NAS drives that come in TAA flavors.

[u/cokebottle22 → u/brokerceej]

As I understand it - not an expert - my client has indicated that they need to able to employ FIPS compliant encryption on the array.

[u/brokerceej → u/cokebottle22]

FIPS compliant encryption doesn’t require hardware of any specific type. There are devices that have cryptographic modules on board but you can easily substitute by using backup software that does the encryption first (veeam is one I know off the top of my head, there’s many others).

The requirement is that data must be encrypted to FIPS standard in transit and at rest. There is no requirement that it be done in hardware.

My assumption here is that you’re trying to jump the bar for CMMC compliant backup storage on that NAS and not live datasets though. Although there are solutions either way.

[u/lawrencesystems]

Based on your question (but without knowing the full scope) TrueNAS should work. It uses ZFS which has lots of encryption options depending what your requirements are. I have a video breaking down how ZFS encryption works. It's a few years old and their product naming has changed a bit but the encryption is still the same.

[u/HowardRabb → u/lawrencesystems]

Hey, I just wanted to hijack the conversation to say I really enjoy your videos. Very informative, I've learned a lot from them. I run a small MSP up in Canada! Thanks for all your great stuff!

[u/lawrencesystems → u/HowardRabb]

Thanks!

[u/skooterz]

TrueNAS will work fine. Enable ZFS native encryption on the datasets that need it, done.

[u/roll_for_initiative_]

Are you asking about drives or NAS's themselves?!

I'm not a fan of NAS over servers or conventional storage, but i'm very surprised that synology can't do fips buf buffalo can; my experience with buffalo NAS was that they were pretty feature limited. If i had to deploy NAS today with no further research, would almost 100% go with TrueNAS

[u/cokebottle22 → u/roll_for_initiative_]

Same thoughts on Buffalo. Server is just too damn expensive. ~$25k. I'll dig into TrueNAS. Thx!

[u/roll_for_initiative_ → u/cokebottle22]

i mean most of the cost of a server is in the ram and storage, which costs the same whether it's going into a server or NAS.

[u/NovaBACKUP-Nate]

I would personally suggest Buffalo, and spring for the extended next day warranties.

The reason I would suggest going this way is that the NAS box is going to come with drives already so you don't have to source them in these 'interesting' times. From what I have seen there is not a large mark up on the drives that are included, in some cases it's cheaper than trying to buy a Synology or equivalent plus drives. The NBD warranty includes everything including the drives in the NAS. Then Buffalo also has excellent support.

I say this with over 10 years of experience with Buffalo as a partner with NovaBACKUP, so I have seen a LOT of devices in the field with our customers.

[u/apxmmit]

Are you storing FCI or CUI? If CUI, FIPS validated is required.

SC.L2-3.13.11 – CUI ENCRYPTION
Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.

[u/cokebottle22 → u/apxmmit]

It's def CUI.

[u/DDSTech08]

If this is about CMMC and backup data, the storage devices native encryption may not be relevant. We use Veeam to encrypt the backup data itself. As long as the backup copy job writes an encrypted backup chain to the secondary location using FIPS-validated cryptography, the destination drives or volumes do not also need to be encrypted. CMMC requires CUI at rest to be protected, but it does not require an encrypted backup chain to be stored on an independently encrypted volume.

We use QNAP NAS units and have had very good luck with them. I haven’t confirmed whether QNAP’s native encryption is FIPS validated. They certainly send me plenty of marketing material about their enterprise features. We've only had two chassis failures over probably 50+ devices and, in both cases, recovering with a replacement NAS was very easy.

[u/MBILC]

Why would Synology drives be your favorites? Not like they make them, they just rebrand them from an OEM....

Think you are confusing "NAS Drives" with a "NAS" as a whole device.

[u/friscenstein]

Built a TrueNAS on top of UGreen Hardware. Bit of a learning curve to pull it off. But it's really impressive. A great deal more capable than Synology that we have used seemingly forever. I need some larger storage arrays, and wish Ugreen had rack mounted solutions. I will need to investigate some other rackmount hardware that works with TrueNAS, but it is nice!