SECURING FIBRE CHANNEL FABRICS - Brocade

Defense Information Systems Agency (DISA)Table 2. Common Criteria evaluation levelsEvaluation Assurance LevelEAL1EAL2EAL3EAL4EAL5EAL6EAL7DefinitionFunctionally testedStructurally testedMethodically tested and checkedMethodically designed, tested, and reviewedSemiformally designed and testedSemiformally verified design and testedFormally verified design and testedIn some cases, a vendor chooses to evaluate a product to a specificEAL but may not have all of the functionality to achieve the next highestlevel. In this case, a vendor can “augment” the EAL achieved with someadditional assurance components from the next highest EAL level.Defense Information Systems Agency (DISA)The US DISA provides real-time IT and communications support to thePresident, Vice President, Secretary of Defense, military services, andcombatant commands. They create a series of security checklists orSecurity Technical Implementation Guides (STIG). The STIGs providebasic guidelines to implement specific types of technology that certaindepartments and groups within the US military must comply with.Hence they are also recognized as security policies. The checklist isused to verify that systems are being implemented in compliance withpolicy and are used as a baseline for audits.One STIG applies specifically to the SAN environment: Sharing PeripheralsAcross the Network (SPAN). It addresses the implementation of aSAN infrastructure and devices connected to it. This STIG enforces itemssuch as zoning, documentation, physical security, and management.A complete list of available STIG checklists can be found at:http://iase.disa.mil/stigs/checklist/.Securing Fibre Channel Fabrics 167