SECURING FIBRE CHANNEL FABRICS - Brocade

SAN Security Myth Number 7SAN Security Myth Number 7Myth. If the switches already come with built-in security features, whyshould I be concerned with implementing security features in the SAN?Reality. Similar to any other IT product, many of the built-in securityfeatures are not enabled by default. For example, Brocade switcheshave about 100 security-specific features available (see “Appendix A:Fabric OS Security FeaturesMatrix” starting on page199), but veryfew of them are enabled when the switch is installed out of the box. Notwo organizations have the same business or security requirementsand each has a different risk tolerance level. Even when over 100security features are available that doesn't mean that all 100+ featuresmust or should be implemented in a given environment.A careful risk analysis and a comprehensive assessment of the stateof security of a SAN environment should be performed first. Subsequently,a SAN security policy should be developed, which will becomethe blueprint for implementing appropriate countermeasures for thatenvironment. The cost and impact of implementing certain countermeasureson a production environment should be factored in. If thecost of implementing the countermeasures and negative impact onperformance or operational efficiency exceeds the benefit gained fromthe higher security, then consider not implementing thatcountermeasure.Chapter SummaryCommon SAN security myths include the notion that since a storagenetwork is physically isolated, it is secure; and that the Fibre ChannelProtocol is impervious to attack both because it is a complicated protocolwith no avenues in and cannot be sniffed. There is also a beliefthat even if data were to be sniffed, it would be incomprehensible andunusable; however simple tests using an inexpensive optical fibersniffer show that to be entirely false. Because every SAN environmenthas its own operational and business requirements, default built-insecurity features on FC switches are not going to ensure SAN security.Certainly more security and storage professionals are asking aboutSAN and storage security than ever before worldwide. The subjectcomes up in conversations every day and both storage and securityprofessionals alike are craving more information so that they cancome up to speed quickly and take the appropriate measures tosecure their SAN.Securing Fibre Channel Fabrics 17