SECURING FIBRE CHANNEL FABRICS - Brocade

Securing the Servers in the DMZpolicies requiring strong passwords and the periodic changing of thosepasswords. This includes forcing at least eight characters, using acombination of alphabetic, numeric and special characters, and preventingthe use of repeating characters and sequences. The passwordpolicy should also set a password expiration time and disableaccounts after a number of unsuccessful login attempts. To simplifypassword management, a single place to administer user names andpasswords for all users and devices is in large environments. RADIUS(Remote Authentication Dial In User Service) and the LDAP (LightweightDirectory Access Protocol) are tools that provide a simple,centralized method to enable and disable user accounts and changepasswords for all switches in a SAN from one centralized location.Securing the Servers in the DMZThe servers in the DMZ should be secured using conventional securitytechniques such as firewalls, anti-virus software, and other methods. Ifa server in a DMZ is compromised and an attacker manages to gaincontrol of the server, he or she can now access the storage devicesattached to that server via the SAN, just as they would if they weredirect-attached. Since these servers are connected to the internal network,the internal IP network is now at risk of attack from acompromised server. Firewalls are commonly deployed to provide abarrier to protect the internal network.Can an attacker use this tactic as a stepping stone into other storagedevices and servers on the SAN? Is the DMZ a potential entry point toperpetrate an attack on the SAN itself? These are the most frequentconcerns expressed by security professionals when deciding whethera server in a DMZ should be connected to a SAN. The following sectionsdiscuss several methods for preventing attackers from using aserver in a DMZ to gain access to other servers or devices connectedto the SAN.Securing the Storage DevicesThere are several common techniques that prevent a server from beingable to see or access storage to which it is not explicitly assigned.Port Disable, Disable E_ports, Port ACLsThe initial step to control device access to a fabric is to disable anyunused FC switch ports and then prevent them from becomingE_Ports. This prevents unauthorized hosts or storage devices from joininga fabric by connecting them to an unused FC port. Port ACLs, suchas the Brocade DCC (Device Connection Control) policy, should be usedto lock a particular host or storage device WWN to a physical port onSecuring Fibre Channel Fabrics 123