SECURING FIBRE CHANNEL FABRICS - Brocade

Other SAN Security Topics10SAN security is still a relatively new field and has not yet achievedmainstream status. Efforts have been made by various organizations,however, including Brocade, to assemble and disseminate more informationon this important subject and develop a more structuredapproach to security in the SAN and storage space. Other organizationsand consortiums are developing new standards, particularly inthe key management space, to simplify and enable interoperabilityamong different vendor solutions.New technologies are emerging in the storage industry that may havea significant impact on how storage will be managed in the future. Asthese new technologies mature, new vulnerabilities and risks willcome along with them.iSCSIThe iSCSI protocol was designed as an alternative to Fibre Channel,but in reality it is a complementary technology. The attraction of iSCSIwas the concept of leveraging an existing LAN infrastructure to alsocarry block-based storage data and thus reduce the cost of a SAN.However, one of the challenges faced by iSCSI is TCP/IP, which can bea very lossy protocol with associated performance degradation. Tocompensate for this, TCP/IP offload engines, or TOE cards, were createdto offload the CPU processing requirements for the TCP/IP stackon the server. This subsequently results in an increase in costs, whichoffset a good part of the benefit of using iSCSI. For this reason, iSCSIhas been primarily used in environments requiring less performance.In enterprise environments, FC is usually deployed for the high-performanceenterprise applications and iSCSI for the less critical, low tomid-performance servers. With the proliferation and reduced cost of10 Gbps Ethernet, iSCSI has seen a greater adoption rate, as this technologyaddresses some of the performance issues previouslyexperienced.Securing Fibre Channel Fabrics 169