SECURING FIBRE CHANNEL FABRICS - Brocade

Why SAN Security?To accomplish this, basic security concepts are introduced for thoseoverseeing the storage environment and then basic storage conceptsare presented to those involved in securing IT assets and electronicinformation. Of value to IT managers may be a review of some of theregulations and legislation in effect throughout the United States andother countries and how they apply to the SAN environment. With theadvent of clouds, the storage and networking teams are more likely towork more closely together to protect assets and information residingwithin the cloud.Although this book is focused primarily on Brocade ® B-Series (classicBrocade) and M-Series (formerly McDATA) technology, the basic SANsecurity principles introduced here can be applied to any fabric or storageenvironment regardless of the vendor implementation. Whilethere may be differences in feature availability and implementationamong vendors, the general concepts and requirements are comparable.The information in this book is based on current research beingperformed by many organizations (full list in Appendix B) and realworldexperience gained from performing actual security assessments,audits, and hardening engagements with Brocade customersthroughout North America.Why SAN Security?Although SAN security is a specialized field dealing with issues specificto the storage industry, it follows the same established principlesfound in all modern IT security. It involves the continuous process ofevaluating an environment’s current state of security against the constantevolution of technology and an increase in awarenessconcerning security issues. As a result, a SAN security strategy is integralto an overall IT security strategy and should address all possiblethreats facing data within a SAN environment.Since 2002, Brocade has been a leader in Fibre Channel SAN security.Based on years of real-world experience deploying SANs of varyingsizes and architectures, Brocade developed a special licensed versionof Fabric OS® (FOS), called Secure Fabric OS, designed to meet thespecific requirements of the most security-sensitive environments. Forinstance, Brocade introduced the first access control lists (ACLs) in theFibre Channel industry and provided the first Fibre Channel authenticationmechanism using Public Key Infrastructure (PKI), which hassince been replaced with the standards-based DH-CHAP (Diffie Hellman- Challenge Handshake Authentication Protocol), a forthcomingSecuring Fibre Channel Fabrics 5