SECURING FIBRE CHANNEL FABRICS - Brocade

Chapter 6: FC Security Best PracticesOperational Security Best Practices Summary• Document critical and frequently used operations• Back up configuration files automatically• Back up log files automaticallyTraining and AwarenessProperly documented procedures certainly mitigate the risks associatedwith SAN administrators making mistakes in day-to-dayoperations. However, personnel must also be trained on how andwhen to use these procedures. This author has seen many procedurescreated with the best of intentions and then left in the darkestrecesses of the computer room or buried under a pile of manuals onthe SAN administrator's desk.In many organizations, training is left up to the individual and RTFM(Read The “Fine” Manual) is the order of the day. This method may beinitially less expensive for the employer, but it can lead to costly errors.Trying out commands that are best left alone or not fully understandingall the consequences of executing certain commands can lead todire circumstances. One particularly dangerous practice is to use theroot account to execute generally undocumented commands. The rootaccount should NEVER be used by system administrators and shouldbe used only by a vendor representative or under the guidance of thevendor.Most people never read an entire manual from cover to cover butrather focus on the sections that address the immediate requirementsto complete a given task. Formal training can provide greater efficienciesin the long run by providing best practices, along with commandsto perform complex operations more efficiently.Training should be aimed not only at the storage administrator but alsoat the security administrator and IT management.Security awareness helps prevent security breaches by sensitizing thestaff to security issues and attack methods used by hackers. One ofthe most frequent attacks by hackers to obtain passwords and othersensitive information is social engineering. For example, a hacker callsa corporate user impersonating an official company help desk or supportperson and requests the user's password or other sensitiveinformation. Users should NEVER divulge their password to anyone,even a real company help desk person.116 Securing Fibre Channel Fabrics