Download Building Secure SANs TechBook

Building Secure SANs
policies. Moreover, without strong authentication and encryption in
the data path, access control is not as secure as one would expect.
Secure access to a management console should include restricting the
IP address for the management application. Switch management
should be done only from secure networks. Remote access should be
provided through a secure tunnel network, such as a Virtual Private
Network (VPN). Secure access can be improved by implementing
two-factor authentication that uses an additional security component,
such as a smart card, so that the access is only given when a user id is
authenticated against a password and a key. Other user login
measures should include policies for password generation/renewal,
key pass phrase requirements, and hash time limitations.
Access control lists (ACL) and policies provide authorization for
access to SAN resources. This form of authentication is known as
Role-Based Access Control (RBAC). Different access levels provide an
additional level of accessible features and functions. Moreover,
RBACs may be used to separate data access from data management.
User login permissions for different access levels, such as equipment
manager, security officer, recovery officer, network admin, storage
admin, and so on, should be set.
Physical access to network ports should also be secured. Key card
access to restricted areas, as well as port controls that are available
from Fibre Channel and IP switch vendors, should be utilized.
Zoning
Fibre Channel switch zoning is analogous to IP-based switch VLANs.
Nodes are segmented into zones and given access to other nodes
within the same zone. Zone members have any-to-any connectivity
within the zone, whereas non-zone members have no connectivity.
Zoning is a technology that uses hardware or software to create
segments in a single SAN fabric.
Vendors have also developed technologies like VSAN, LSAN, and
VLAN tagging that use hardware and software to create separate
SAN fabrics, preventing even zoning to be performed across fabrics
unless routed. The purpose is to allow the grouping of a set of nodes.
As a result, access is limited to a certain set of nodes (either initiators
or targets) whereby both intentional and unintentional access to data
is restricted. Other advantages of zoning include lowering the effects
of State Change Notifications (SCN) and broadcasts, as well as
controlling traffic of particular nodes for performance.
28
Building Secure SANs TechBook