SECURING FIBRE CHANNEL FABRICS - Brocade

Chapter 4: Security Basics for Storage ProfessionalsThe key to minimizing the risks associated with this type of threat is todevelop solid, well-documented operational procedures and restrictadministrator privileges to only the tasks that are required for anadministrator's job functions. Organizations should not grant additionalprivileges to a trusted, long-term, or favored administrator whenthose privileges are not required for that administrator's job functions.Malicious insider threats typically involve employees or contractorswho have something to gain from exploiting a weakness in the system.These threats are the most difficult to manage and control, since theyinvolve people who have legitimate access to the targeted systems.The key to mitigating risks from this type of threat is to limit the privilegesa specific individual has and to distribute workload andresponsibilities among multiple administrators. In the event that asecurity incident occurs, it is important to have a proper incidentresponse procedure in place, with clear methods to track administratoractivities and provide evidence for any potential criminal or civilinvestigation.The following list, while not comprehensive, provides important pointsto consider when defending against insiders:• Proper hiring and screening practices• Limited access to facilities and assets• Personal identifiers, physical and digital• Appropriate controls• Monitoring• Procedures and policies• Incident response• Training and awarenessThe first step, and probably the most important, is to perform appropriatebackground checks on employees before they are given the “keysto the kingdom.” Background checks can be basic or exceptionallycomprehensive, depending on the nature of the systems they will begranted access to and the nature of the organization’s requirements.For military and intelligence positions involving national security, a topsecret clearance or higher may be required.A top secret clearance requires the investigation of a person's history,relationships, lifestyle, financial positions, and includes a polygraph(lie detector) test. For other employees, a simple verification of refer-56 Securing Fibre Channel Fabrics