SECURING FIBRE CHANNEL FABRICS - Brocade

Encrypting Data-at-Restand disk devices and also work with a variety of third-party vendorappliances. This provides organizations with greater flexibility andindependence from the storage vendors.Host-Based EncryptionHost-based encryption can be implemented using software installedon the host. The greatest issue with host-based software encryption isthe negative performance impact resulting from CPU utilization of theencryption application.Storage-Based EncryptionTape-based hardware encryption solutions have the advantage ofbeing implemented in hardware and operating at wire speeds with noobservable performance degradation during a backup operation. Onthe other hand, these solutions require new specialized tape driveswith built-in encryption capabilities (such as LTO-4 or -54).Although this solution addresses the tape encryption problem quiteeffectively, it does not address disk encryption. Many organizationsbegin with a data-at-rest encryption project exclusively to address atape encryption problem. However, even without an internal policy, it ishighly likely that regulations or legislation will eventually force theencryption of both disk and tape media. Addressing the disk encryptionrequirement would require a disk encryption solution that usesdifferent encryption hardware.Disk-based or array-based hardware encryption solutions are nowavailable from several vendors. Similar to tape encryption, disk-basedencryption addresses disk encryption effectively. Disk-based encryptiondoes not, however, address tape encryption. Furthermore,rekeying of data (re-encrypting a LUN with a different key) can only beperformed as a data migration process with current disk-based orarray-based encryption solutions.Physical SecurityPhysical security is a vast subject and this book cannot do justice tothe topic. However, some best practices that apply to the SAN environmentare highlighted in this section. Most organizations assessed bythe author were found to have adequate physical access controls tothe computer room and the SAN equipment; hence, this aspect ofphysical security will not be addressed here. Note that this area ofsecurity is generally addressed by a different group than the storage orsecurity administrators.Securing Fibre Channel Fabrics 113