SECURING FIBRE CHANNEL FABRICS - Brocade

Chapter 6: FC Security Best PracticesFor more secure environments, it is possible to restrict management toone specific management point in a fabric. It is common practice inphysical security to have only one entry and exit point into a facility,since it is easier to manage and control a single entry point than it is tocontrol multiple entry points. This is the primary reason why mostenterprise computer rooms only have one access door.Fabric management can be performed using any switch in a fabric,which means that multiple management points are available. Using afabric configuration server (FCS) policy, administrators can specify aspecific switch as the only management point and they can alsoassign alternative switches as backup management switches in theevent the primary management switch fails.Management Interface Best Practices Summary• Use a separate LAN or VLAN for the management network—never use the production network for the managementinterfaces• Use secure protocols to access management interfaces (SSH,SSL)• Disable the equivalent unsecure protocols• Limit the points of entry for management (use FCS policy ifnecessary)Maintaining Data ConfidentialityConfidentiality as it pertains to electronic data is the protection ofinformation from being disclosed to unauthorized users. In the contextof a SAN, data is either in flight on a cable (data-in-flight) or at rest on astorage media, tape or disk (data-at-rest); both discussed in the followingsections.108 Securing Fibre Channel Fabrics