SECURING FIBRE CHANNEL FABRICS - Brocade

Chapter 6: FC Security Best PracticesLog files. Since logs are ubiquitous and all IT systems use them,sophisticated attackers will often try to destroy the log files followingan attack to remove any traces or evidence of their activities. To preventor minimize the risk of this occurrence, the syslog should beredirected to a more secure alternate location, which can be done onmost systems, including on Brocade switches.Different FC equipment vendors offer various levels and types of logging,but they are often not enabled by default. For example, onBrocade switches, the following logging features are not enabled bydefault:• Event auditing• Track changes• Fabric Watch security classTo obtain more detailed logging, these logging features should beenabled.An often neglected but important detail with log files is the time stamp.Switches and other FC devices in a SAN run their own internal timeclocks. Without any means of synchronization, the clocks on eachdevice will be different and make it virtually impossible to correlate anevent in the log file of one device with the log file of another device.This problem can be resolved simply by using the Network Time Protocol(NTP) to synchronize the time on each device. This can beaccomplished by specifying an NTP server, either an external or internalone, and each device will then synchronize its internal clock withthe NTP server.Monitoring. When a security breach occurs, it is imperative to detect itas soon as possible to allow for a quick response and prevent or minimizedamage caused by the attack.All FC switch vendors provide a GUI to manage their switches. The GUIis usually the primary management tool to monitor the status of theSAN in real-time. Unfortunately, a critical event may not be observedimmediately unless a SAN administrator is posted in front of the GUI atall times and pays constant attention.To automate monitoring, other tools can provide automated alerts inthe form of e-mail notifications or pages. Often, SNMP (Simple NetworkManagement Protocol) is used to send traps to a third-partymanagement framework. Since the SNMPv1 protocol has known vulnerabilities,as a best practice use SNMPv3.106 Securing Fibre Channel Fabrics