SECURING FIBRE CHANNEL FABRICS - Brocade

Chapter 2: SAN Security MythsSAN Security Myth Number 1Myth. SANs are inherently secure since they are in a closed, physicallyprotected environment.Reality. It is generally true that a SAN is installed within a secure,access-controlled data center. Appropriate physical security measureshelp prevent unauthorized outsiders from gaining access to the computerequipment.However, most security incidents affecting storage and SAN environmentsare attributed to insiders or outsiders with the assistance ofinsiders. Adequate physical security does not prevent insiders fromcausing security breaches, intentional or otherwise. Protection againstinsider threats is most likely the greatest challenge facing security professionals.However, specific measures can be implemented to helpprevent or mitigate the risks associated with insider threats. It isimportant to note that insider threats are not always malicious; in factmost often they are not. On the issue of employee trust, employeescan unexpectedly “go rogue” and it is difficult to predict which oneswill do so.Finally, most insider incidents are the result of errors during the courseof daily operations. Measures can be implemented to reduce the numberof errors and to mitigate the risks associated with them, such asusing well-documented procedures and monitoring tools.SAN Security Myth Number 2Myth. The Fibre Channel protocol is not well known by hackers andthere are almost no avenues or tools available to attack fabrics.Reality. There is unquestionably some merit to this statement and FCbasednetworks are undoubtedly more secure than conventional TCP/IP networks. For many reasons, some organizations prefer to separatestorage traffic from production traffic on isolated networks specificallyfor this purpose. This exemplifies the concept of separation of dutiesand isolating different functions from one another within a commonenvironment. There is also some value in utilizing different technologiesin the same environment. An attacker with a malicious intent maybe quite knowledgeable about TCP/IP networks and would be able toget past the first hurdle but would be stumped when reaching the FCnetwork, hampered by lack of skill with this technology.Nevertheless, every FC device uses the TCP/IP protocol for managementinterfaces. Given that TCP/IP is well known by the “black hat”(hacker) community and many exploits are readily available on the10 Securing Fibre Channel Fabrics