SECURING FIBRE CHANNEL FABRICS - Brocade

FC Security Best Practices6In previous chapters, basic security and encryption concepts wereintroduced in addition to FC SAN basics. This chapter puts it alltogether so that you can apply these security concepts in the form ofbest practices in your FC SAN environment. It offers guidelines thatcan be used by SAN administrators and security professionals to helpbuild a SAN security policy and decide which features should bedeployed. Implementation of these features will be explained ingreater detail in “Chapter 8: Securing FOS-Based Fabrics” starting onpage 131.When you design a SAN security policy, it is not necessary to implementand enable every available security feature. Some securityfeatures add performance overhead, others may affect administratorproductivity, and yet others may have associated implementationcosts. A balance must be struck between the features and the value ofthe assets being protected, and the probability that the system vulnerabilitywill actually be exploited.The Brocade SAN Security ModelThe concept of defense-in-depth was discussed previously and can beextended to a security model for protecting a SAN. A complete SANsecurity strategy should provide multiple layers of challenge to anattacker to provide the best protection against all types of threats.The diagram in Figure 35 illustrates the Brocade SAN security model.This is not an authoritative model but more of a guide to help visualizethe components necessary to build a strong SAN security program.Securing Fibre Channel Fabrics 91