SECURING FIBRE CHANNEL FABRICS - Brocade

Chapter 11: Brocade Data Encryption ProductsA rekey operation could be required after the LUN's DEK has beencompromised or after it has expired. It is possible to configure the Brocadeencryption device to automatically begin a rekey operation oncethe DEK expires. However, as a best practice, it is preferable to configurethe encryption device manually to perform the rekey operation.Since a rekey operation is very I/O intensive and may negativelyimpact application performance, a manual rekey would allow thescheduling of the rekey operation when it is more convenient, such asduring off-peak hours.Other Best PracticesFirmware UpgradesFirmware upgrades on the Brocade encryption device are disruptive toencryption traffic I/O. However, layer-2 FC traffic that is not being redirectedwill not be affected, but redirected traffic will be affected sincethe encryption engines and Blade Processor must reset.To avoid production downtime for disk environments using a dual-fabricconfiguration, upgrade the switches on Fabric A first and then failover the traffic back to Fabric A. When both paths are online again,Fabric B is failed over to Fabric A and Fabric B is upgraded.To avoid impacting production for tape environments attached to a singlefabric, it is simply recommended to perform the upgrade during offhoursor in the next available maintenance window.Key ManagementKey Expiration. Part of managing the keys is determining how long akey should exist. Many organizations never expire a key, while othersrequire expiration every six months (or more). There is no general ruleas to the frequency of key expiration and it depends entirely on thebusiness requirements and tolerance to the risk that a 256-bit key willgo stale or be compromised. Since an online rekey operation canaffect application performance and an offline rekey requires downtime,most organizations would rather not perform a rekey toofrequently. Generally, it is considered safe to expire 256-bit keys somewherebetween every two to four years.Key-Per-Media vs. Key-Per-Pool. For tape encryption, a single DEK canbe assigned to one tape media or to an entire pool of tapes. The bestpractice is to have one DEK per tape media. In the event the DEK iscompromised, it is much simpler to create a new backup for one tapeas opposed to an entire pool of tapes.194 Securing Fibre Channel Fabrics