SECURING FIBRE CHANNEL FABRICS - Brocade

Attackstion between the two parties. The result is that the two parties believethey are communicating directly with each other, but in fact they arecommunicating through a third party. The third party can then storethe traffic exchanged between the two parties and use the informationfor a subsequent attack. For example, a GUI using HTTP to manage aswitch can be compromised by an MITM attack. To prevent this, anend-point authentication mechanism such as SSL can be used tosecure the channel between the GUI and the switch.SpoofingSpoofing refers to taking on the identity of another device or person.Spoofing can be used in SANs by assigning the WWN of a knowndevice in a fabric to another host's HBA and introducing it into the fabric.The FC protocol does not have any mechanism to prevent duplicateWWNs in a fabric. This may seem odd at first, but it is similar to theEthernet protocol, in which duplicate MAC addresses are allowed. Infact, some NICs come with several Ethernet ports and by default, eachport shares the same MAC address. This is usually done to reduce thenumber of entries in the arp table where the MAC addresses arecached on the server.As of FOS 7.0, Brocade has implemented measures (discussed later)to modify the behavior of an FC switch when a duplicate WWN isdetected at login. One possibility would be to configure switches toreject any devices attempting to login with a duplicate WWN.As shown above, there are many techniques a hacker can use tobreach a system. All SANs have vulnerabilities that can be exploited,and special measures are required to protect against these attacks.The next section looks at how to protect against these attacks and mitigatethe risks associated with them.Securing Fibre Channel Fabrics 61