SECURING FIBRE CHANNEL FABRICS - Brocade

Key ManagementSSL can be used with several protocols, although it is used primarilywith HTTP. For example, SSL is used to secure communications betweena Brocade management graphical user interface (GUI) and a Brocadeswitch. The secured version of HTTP in this case is called HTTPS.IPSecIPSec (IP security) is a framework that performs encryption at the routinglayer (IP - Layer 3) in the TCP/IP stack. IPSec is commonly used tosecure communications in a virtual private network (VPN), but it canbe used simply to encrypt communications between two devices on anetwork. IPSec can either encrypt only the payload or data (transportmode) or it can encrypt the payload and the header information (tunnelmode).Since it is a framework, it does not actually specify which encryption orhashing algorithms to use but leaves this decision to the user. Forexample, IPSec can be used to encrypt communications between twoBrocade 7800s using FCIP to replicate data between two data centers.Brocade's implementation of IPSec supports the following encryptionand hashing algorithms.Encryption algorithms:• 3DES• AES-128 (default)• AES-256Hashing algorithms:• SHA-1 (default)• MD5• AES-XCBCKey ManagementThe decision to encrypt information residing on disk or tape creates along-term commitment and a dependence on the encryption keys.After being created, keys need to be backed up and managed. Keyscan be lost, stolen, destroyed intentionally, or expired after a pre-determinedperiod of time-all potential security vulnerabilities.Loss of the encryption keys is comparable to losing the data. Unlikedata-in-flight, the keys for data-at-rest must be available for as long asthe data needs to be read. In the case of patient health records, informationmay need to be retained for seven years after the death of aSecuring Fibre Channel Fabrics 87