SECURING FIBRE CHANNEL FABRICS - Brocade

Types of Threatsences from previous employers or a credit check may be sufficient. Acredit check may not seem relevant at first, but if a potential employeehas considerable financial difficulties, then this could indicate a weaknessin that person's life, which could be exploited by a criminalelement.Once hired, employees should be given access only to assets or facilitiesthey need to perform their job function. Providing an access cardto allow an employee to enter a building should not necessarily implythat the employee can now access all areas within the building. Thesame applies to accounts and passwords. A database administratormay be granted root privileges on the database servers for which theyare responsible, but they should not have similar powerful privilegeson the backup server, Web servers, or any other applications/serversthey are not directly responsible for managing. This general concept isalso known as “separation of duties”.Each individual employee should have a unique identifier assigned tothem. A building access card, for example, should be unique and havea photo of the employee on it. When employees log into a system, theyshould use their personal account with the appropriate privilegesinstead of the generic root or admin accounts, which could be used byanyone. The intention is to be able to associate an action with a personin a manner that cannot be repudiated.Appropriate controls should be put in place to limit access and detectanomalies or inappropriate behavior. These could be in the form ofaccess control lists (ACL) or role-based access control (RBAC) assignedto individual users restricting what they can do. Programs can log allaccess to files and file systems, computer systems, facilities, and soon.Once controls are in place, they must be monitored. There is obviouslyno sense in capturing valuable access information in log files if no onelooks at the log files. A recommendation on the frequency of monitoringvaries depending on the type of assets being protected. Some eventsneed to be monitored only occasionally, while others need to be monitoredin real-time to provide an immediate response to a breach. Fireand burglary alarm systems are examples of real-time monitoring systemsas are credit card fraud detection systems. Many, if not most,security breaches result from operator error. Creating well-documentedand detailed operations procedures helps mitigate risks associatedwith operator error. Security policies also mitigate these risks by estab-Securing Fibre Channel Fabrics 57