SECURING FIBRE CHANNEL FABRICS - Brocade

Design and Implementation Best PracticesDesign and Implementation Best PracticesThe Brocade Encryption Switch, like any other security product, doesnot come fully configured out of the box. It must be configured properlyand be part of a well-designed architecture with the appropriate operationalprocedures to ensure continuous and secure operation. Thissection outlines some best practices for the design and implementationof the Brocade encryption solution.Encryption is only one component of a comprehensive SAN securityprogram. An organization may have the best encryption solution possible,but if it is installed on a SAN with security holes, then the entiresolution may be vulnerable. In security, a system is only as strong asits weakest link, which is usually the place attackers will target first.The design and best practice recommendations in this chapter are notmeant to be comprehensive. For more information on design andimplementation best practice for the Brocade encryption solution,please refer to the Brocade Encryption Best Practices Guide, availablethrough the local Brocade contact person.Management InterfacesManaging and configuring the Brocade encryption solution can be performedeither with the FOS CLI or Brocade DCFM/BNA Enterpriseversion, as well as DCFM/BNA Pro/Pro+. As a best practice, it is highlyrecommended to use DCFM/BNA. The CLI requires several commandsto perform certain operations, which can be performed with onemouse-click in DCFM/BNA. Furthermore, typing multiple CLI commandsincreases the risk of typing errors, resulting in potentialconfiguration errors. The DCFM/BNA interface also provides wizardsthat guide users through the configuration process to further reducethe risk of errors introduced as a result of improper sequencing ofcommands.The management interfaces should never be accessed using unsecureprotocols such as telnet for the CLI or HTTP for DCFM/BNI. Usesecure protocols, such as SSH instead of telnet and HTTPS instead ofHTTP, and block or disable their equivalent unsecure services.For additional protection, the System Card or ignition key featureshould be implemented and a Smart Card required, enabling theencryption capability of the switch. This will prevent someone whosteals both the switch and the disk media from being able to decryptthe data on the storage media. Of course, it is equally important tostore the System Card in a secure location away from the encryptionswitch and storage media.Securing Fibre Channel Fabrics 191