Strategies for Data Protection - Brocade

SAN SecuritySecuring the SAN Data TransportThe fact that the majority of SANs are based on Fibre Channel insteadof TCP/IP has created a false sense of security for data center storagenetworks. Hacking Fibre Channel data streams would require veryexpensive equipment and a high degree of expertise. In addition, thephysical security of data center environments is often assumed to providesufficient protection against malfeasance. As SAN technology hasbecome ubiquitous in data centers, however, no one should assumethat the SANs are inherently secure. Simply reconfiguring a server so itnow has access to designated storage assets could enable unauthorizedaccess to valuable corporate information.Although Fibre Channel has relied on the physical separation of communicationnetworks and storage networks to provide a rudimentarysecurity barrier, modern business practices require a much higherassurance of data defense. Physical isolation alone does not providesecurity against internal attacks or inadvertent configuration errors.The storage industry has therefore responded with a spectrum ofsecurity capabilities to provide a high degree of data protection, whilestill maintaining the performance required for storage applications.ZoningAt a low level, zoning of resources in the SAN provides authorizedaccess between servers and storage ports through the Fibre Channelnetwork or fabric as illustrated in Figure 13. Zoning can be port based,restricting access by authorizing only designated Fibre Channel switchports and attached devices to communicate to each other. Alternately,zoning can be based on a 64-bit Fibre Channel World Wide Name(WWN). Since each Fibre Channel device has a unique WWN, it is possibleto authorize connections based on the unique identity of eachdevice.Strategies for Data Protection 25