SECURING FIBRE CHANNEL FABRICS - Brocade

The Brocade SAN Security ModelWith Brocade switches, the Fabric Watch feature can be used to monitorspecific fabric and switch events and generate an SNMP trap orsend an e-mail to alert administrators of the event. Specifically, FabricWatch has a Security class to monitor specific security events such asunsuccessful login attempts and device access control policyviolations.Logging and Monitoring Best Practices Summary• Redirect the syslog to a secure server• Enable all event auditing and change tracking features• Synchronize all switches and directors using NTP• Use real-time monitoring of important security events• Monitor all logs on a regular basis• Use a real-time management tool to monitor security events• Use an automated alerting method for notification of securitybreachesProtecting Management InterfacesThis has been repeated several times so far in this book but it cannotbe emphasized enough: management interfaces are one of the mostvulnerable points in the SAN. It is important to use appropriate proceduresand protocols when using the management interfaces for allcomponents in the SAN including the HBA, storage devices, and FCinfrastructure devices (switches, directors, backbones, and routers).One of the simplest techniques for protecting management interfaces isto use a separate LAN, subnet, or VLAN to isolate the management networkfrom the production network. This limits access to themanagement network to SAN administrators only and not to the companyat large.Since insiders can be a significant threat, it is also good practice touse secure protocols to encrypt the communications between managementworkstations and the devices being managed. This can bedone using protocols such as SSH and SSL/HTTPS. If secure protocolsare used, then it is equally important to disable the equivalent unsecureprotocols. For instance, if the security policy now requiresadministrators to log into switches using SSH, then telnet access (port23) should be disabled. If HTTPS is the protocol of choice, then HTTP(port 80) should be disabled.Securing Fibre Channel Fabrics 107