SECURING FIBRE CHANNEL FABRICS - Brocade

SAN Basics for SecurityProfessionals3Although a SAN is a network, it differs significantly from the conventionallocal area network or TCP/IP-based network. Since security professionalstend to be unfamiliar with SANs, they often overlook or ignore securityissues for these networks. This chapter is for IT security professionals withlittle or no knowledge of storage and the SAN. Storage professionals mayelect to skip this chapter and continue with the next chapter, which discussessecurity basics for storage professionals.One of the first questions you might ask is this: Why do you need a SANto begin with?The original model for open data storage was direct-attached storage(DAS), in which each server had its own storage directly attached usingthe Small Computer Systems Interface (SCSI, pronounced “skuzzy”) orother protocol. While the DAS model worked well in the early days ofthe data center, it became clear that DAS had reached its limits whenthe importance and scale of IT infrastructure outgrew it in the 1990s.DAS was inefficient, since some disks had large amounts of emptyspace while others were completely full, and additional disks had to bepurchased. This led to a need to pool disk storage into one centrallocation and share the resources with all hosts to optimize utilizationof the storage devices. Broadly, this category of solution is known aswhite space optimization.SCSI also had distance limitations and could be used only to connectdevices in the same rack or at best to another device in an adjacentrack. This precluded its use for most high-availability applications andall disaster recovery solutions. SCSI performance was also an issue forstorage applications, particularly backup applications, whichdemanded increased bandwidth to meet growing business requirementsand shrinking backup windows.Securing Fibre Channel Fabrics 19