SECURING FIBRE CHANNEL FABRICS - Brocade

Chapter 6: FC Security Best Practicesfurther exposure. Management should be represented to make rapidhigh-level decisions to minimize the impact of an incident and enablea proper response if unexpected costs are involved.It is not necessary to have a CSIR plan or a team specifically for the SANenvironment, but members of the SAN management team should certainlybe involved in building the CSIR plan and participating in the CSIRT.Policies Best Practices Summary• Apply IT security policy to the SAN environment• Develop a specific SAN security policy• Build a DR/BC plan for the SAN or integrate the SAN into anexisting DR/BC plan• Participate in the company CSIR plan and teamAssessments and AuditsAlthough the terms “assessment” and “audit” are sometimes usedinterchangeably, there is a subtle but important difference betweenthe two. An audit is a verification process to establish whether a policyor industry standard is being followed. To perform a SAN security audit,an industry standard or an internal SAN security policy must exist.Since there are no official industry standards in the US currently, thisleaves an internal SAN security policy as the basis for an audit. TheStorage Network Industry Association (SNIA) sponsors a Storage SecurityIndustry Forum (SSIF) that has been developing a Best CurrentPractices (BCP) document for storage security. (See “Appendix B: StandardsBodies and Other Organizations” starting on page 205.) Thisdocument is not an accepted industry standard, but it is a good referenceto help security and storage professionals build an internal SANsecurity policy.An assessment, on the other hand, is not formal and its scope is notrestricted to boundaries established by a policy or industry standard.An assessment is complementary to an audit. Some organizationswith internal security policies perform yearly audits, but they also performa comprehensive assessment to validate, expand, and updatethe existing security policy.Usually, organizations without a SAN security policy in place, or thosewho want to integrate the SAN environment into the existing IT securitypolicy, have an assessment performed by a third-party vendor specializingin SAN security.118 Securing Fibre Channel Fabrics