SECURING FIBRE CHANNEL FABRICS - Brocade

Chapter 4: Security Basics for Storage ProfessionalsNon-RepudiationNon-repudiation is used to prevent someone who has performed anaction from refuting it and claiming they have not performed action inquestion. For example, someone makes a purchase on the Internetand then claims they never made the purchase once they receive thegoods. Non-repudiation is an essential element in conducting business.This also applies in the other direction in a situation in which ane-commerce website provides proof of payment to the customer. Historically,these functions have been performed using physicalsignatures and receipts, which then become legal and binding contractsfor both parties. The same actions are performed electronicallyusing digital signatures and signed certificates, and other methodssuch as the Confirm button on some Web forms.AuthenticationAuthentication is the process of verifying that people really are whothey claim to be. There are several ways to authenticate an individual,including user accounts and passwords. Authentication methods canbe quite sophisticated with biometric technology such as fingerprintscanners, face/voice recognition, and iris/retinal scanners. Each ofthese methods is known as a factor of authentication and can be usedin combination, known as multi-factor authentication, to providegreater certainty of authenticity. Factors of authentication will be discussedin greater detail in the physical security section (see “PhysicalSecurity” on page 113).The Parkerian HexadThe Parkerian Hexad is a set of six fundamental concepts of informationsecurity, initially proposed by Donn S. Parker. The term wasactually coined by M.E. Kabay from Norwich University. The ParkerianHexad is an extension of the CIA triad discussed previously and introducesthree new elements: possession or control, authenticity, andutility.Possession or ControlIf possession is nine-tenths of the law, it has never been more truethan in IT security. Loss of control or possession of data must be preventedat all costs, since it must be assumed that once the owner nolonger has control, the data is necessarily compromised. Suppose thata backup tape containing customer and credit card information is lostor stolen-a frequent occurrence in recent times. Even if the tape wassimply misplaced and no data has actually been read, the assumptionmust be that the data on the tape is now known and appropriate mea-48 Securing Fibre Channel Fabrics