SECURING FIBRE CHANNEL FABRICS - Brocade

Chapter 4: Security Basics for Storage ProfessionalsFrom a storage perspective, biometrics are often used to accesssecure computer rooms and are sometimes used for authentication togain access to a management workstation.User Accounts and PasswordsThe user account is the principal method to identify a user whorequests access to an IT system. The password is the primary methodof authenticating the identity of a user. At first glance, the useraccount and password authentication method would appear to be atwo-factor authentication method, but in fact both items are somethinga person knows, so they are two aspects of the same factor.When the user account and password method is used in combinationwith another authentication method such as a smart card, a commonaccess card (CAC, used in military and intelligence communities), or afingerprint reader, then it becomes a two-factor authenticationmethod. Another popular two-factor authentication method uses apiece of hardware called a token, which generates a new authenticationcode at regular intervals, usually ranging from 30-60 seconds.Since this authentication code continually changes, the user does notneed to memorize an access code or change it periodically.Passwords are a bit like chewing gum in some respects. You don't wantto share it with other people, it gets stale after a while, and it makes abig mess if you leave it lying around!Passwords should be unique to an individual and not shared betweengroups of individuals. For example, the root or other super useraccount (like admin) should not be used by multiple system administrators.Pre-defined system accounts with a default password shouldalways be changed when the system is first installed. One of the firstthings an experienced hacker might do when attempting to break intoa system is to use the factory default passwords for that particular system.These passwords are very easy to obtain and a simple Websearch for “vendor_name root password” will most likely generate multiplehits with several sources offering comprehensive lists of vendorsand passwords.As time goes by, a password has a higher probability of being discoveredand compromised; therefore it is important to change passwords on aregular basis. How often the password should be changed depends onthe environment. If the password is changed too often, then it becomesmore difficult for the user to remember. As a result, many users simplyresort to writing their password down and keeping it somewhere handysuch as under their keyboard or on a post-it note on the side of theirmonitor, not the safest places to keep a password secret.64 Securing Fibre Channel Fabrics