SECURING FIBRE CHANNEL FABRICS - Brocade

Chapter 4: Security Basics for Storage ProfessionalsBack DoorA back door allows someone to bypass the normal access methods toget into a system. It can have many forms, such as a program with hiddencode that allows its creator to enter a system at a later date.Sometimes a host can be bypassed by placing it in single-user modeand bypassing the operating system authentication mechanism. Aback door can also be a default account, such as those used by maintenancetechnicians to gain access to a system when users haveforgotten their password to access the system. This is one reason whyit is extremely important to change all default account passwords for anew system. A simple Web search reveals default account passwordsfor most major IT equipment vendors (including Brocade).SniffingSniffing is the act of capturing traffic on a network. It can be accomplishedusing highly sophisticated and expensive equipment such as atrace analyzer. Or it can use inexpensive, readily available equipmentsuch as software on a computer that places the network interface card(NIC) in promiscuous mode to capture all traffic that reaches it. Asseen in “Chapter 2: SAN Security Myths” starting on page 9, sensitiveoptical couplers can be purchased for under $1,000 to sniff traffic onan optical fiber cable without having to splice the cable. The data itselfcan be stored on any computer, including a laptop, and with packet filteringsoftware, unnecessary traffic or noise can be filtered out andonly the interesting traffic is kept.Denial of ServiceA denial-of-service (DoS) attack aims at disabling systems or preventingthem from performing their intended function. Powering off an FCswitch or storage array is a simple form of a DoS attack. A distributedDoS (DDoS) attack is more sophisticated and requires the collaborationof large numbers of computers, usually infected with a sleepingprocess called a “zombie,” which simultaneously sends a large numberof requests to a Web server, resulting in congestion that may bringthe system down. The first such attack of significance was performedby an adolescent with the aid of several programs he downloaded fromthe Internet, and he managed to bring down several Web sites includingCNN, Yahoo!, Ebay, Amazon, E*Trade, and Dell.Man-in-the-MiddleA man-in-the-middle (MITM) is an active form of sniffing in which anunauthorized third party is introduced between two legitimate partiescommunicating with each other. Often, the MITM pretends to be one ofthe parties during the authentication process and then relays informa-60 Securing Fibre Channel Fabrics