SECURING FIBRE CHANNEL FABRICS - Brocade

Chapter 4: Security Basics for Storage Professionalslishing guidelines and rules for employees to follow. Policies also serveto protect the company from liability in the event of an employee actingagainst approved company policy.Once policies and procedures are in place, they need to be enforced. Ifa policy is established but infractions are always without consequence,then it will lose its effectiveness over time. Infractions mustbe flagged in some way, even if it is only a friendly reminder that a certainbehavior has been observed with a link back to the policy for theemployee to review. Of course, for significant or repeated infractions,sanctions may be more drastic and include employee dismissal oreven criminal charges in extreme cases.Finally, one of the most overlooked aspects with insiders is trainingand awareness. Training provides improved knowledge resulting ingreater efficiency and reduction of operational errors. Awareness trainingalso reduces the frequency of the type of error caused by notrealizing the impact of certain actions, as described in the examplesbelow.A classic technique used by hackers to gain access to systems iscalled social engineering. This technique involves manipulation of trustwhen a person impersonates or assumes authentic-seeming characteristics.A common social engineering technique is to impersonate ahelp desk person and ask an employee to update their company profile.During this process, the unsuspecting employee will be asked toprovide their password so that the “help desk person” can log in andmake the necessary changes. Another commonly used social engineeringtechnique is phishing. A hacker may send an e-mail to anindividual requesting them to update their account profile for theirinvestment bank, for example. They are asked to follow a link whichleads them to a phony, but authentic-looking, website. As the user logsin to update their profile, their account and password information iscaptured and subsequently used to perform unauthorized transactionsin their account. Raising the awareness of all employees of theschemes and strategies used by hackers to obtain information is aneffective method of combating hacking via social engineering.58 Securing Fibre Channel Fabrics