Storage Security: Fibre Channel Security
Total Page:16
File Type:pdf, Size:1020Kb
Storage Networking Industry Association Technical White Paper Storage Security: Fibre Channel Security Version 1.0 May 20, 2016 Abstract: The ISO/IEC 27040:2015 (Information technology - Security techniques - Storage security) standard provides detailed technical guidance on controls and methods for securing storage systems and ecosystems. This whitepaper provides an overview of the Fibre Channel (FC) security guidance in the standard as applied to Storage Area Networks (SAN). It also provides additional SNIA guidance in developing a FC security program to meet organizations’ particular needs. USAGE The SNIA hereby grants permission for individuals to use this document for personal use only, and for corporations and other business entities to use this document for internal use only (including internal copying, distribution, and display) provided that: 1. Any text, diagram, chart, table or definition reproduced shall be reproduced in its entirety with no alteration, and, 2. Any document, printed or electronic, in which material from this document (or any portion hereof) is reproduced shall acknowledge the SNIA copyright on that material, and shall credit the SNIA for granting permission for its reuse. Other than as explicitly provided above, you may not make any commercial use of this document, sell any or this entire document, or distribute this document to third parties. All rights not explicitly granted are expressly reserved to SNIA. Permission to use this document for purposes other than those enumerated above may be requested by e-mailing [email protected]. Please include the identity of the requesting individual and/or company and a brief description of the purpose, nature, and scope of the requested use. All code fragments, scripts, data tables, and sample code in this SNIA document are made available under the following license: BSD 3-Clause Software License Copyright (c) 2016, The Storage Networking Industry Association. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. * Neither the name of The Storage Networking Industry Association (SNIA) nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. Fibre Channel Security SNIA Technical White Paper 2 May 20, 2016 DISCLAIMER The information contained in this publication is subject to change without notice. The SNIA makes no warranty of any kind with regard to this specification, including, but not limited to, the implied warranties of merchantability and fitness for a particular purpose. The SNIA shall not be liable for errors contained herein or for incidental or consequential damages in connection with the furnishing, performance, or use of this specification. Suggestions for revisions should be directed to http://www.snia.org/feedback/. Copyright © 2016 SNIA. All rights reserved. All other trademarks or registered trademarks are the property of their respective owners. Fibre Channel Security SNIA Technical White Paper 3 May 20, 2016 Revision History Revision Date Sections Originator: Comments V0.1 4/2/2015 All Eric Hibbard Initial Draft V1.0 5/20/2016 All Eric Hibbard Final 1.0 Text Suggestion for changes or modifications to this document should be submitted at http://www.snia.org/feedback/. Foreword This is one of a series of whitepapers prepared by the SNIA Security Technical Working Group to provide an introduction and overview of important topics in ISO/IEC 27040:2015, Information technology – Security techniques – Storage security. While not intended to replace the standard, they provide additional explanations and guidance beyond that found in the actual standard. Fibre Channel Security SNIA Technical White Paper 4 May 20, 2016 Executive Summary Fibre Channel is often viewed as a specialized form of networking that lives with data centers and neither has or requires special security protections. Neither of these assumptions is true, but finding the appropriate details to secure Fibre Channel infrastructure can be challenging. This SNIA storage security whitepaper leverages the guidance in the ISO/IEC 27040 standard and provides value added information on Fibre Channel as it relates to storage systems and ecosystems. 1 Introduction ISO/IEC 27040:2015 Information technology - Security techniques - Storage security provides detailed technical guidance in securing storage systems and ecosystems (see Appendix A for an overview). While the coverage of this standard is quite broad it lacks details for certain important topics. This whitepaper, one in a series from SNIA that addresses various elements of storage security, is intended to leverage the guidance in the ISO/IEC 27040 standard and enhance it with a specific focus on Fibre Channel (FC) security. The whitepaper provides background information on Fibre Channel, summarizes the FC security options, explores the relevant ISO/IEC 27040 guidance, and offers additional information to help secure FC-based storage. 2 Storage Technology Overview This section briefly describes key storage technologies with the intent of setting the stage for the security descriptions and guidance. 2.1 Storage Area Networks (SAN) A Storage Area Network (SAN) is a specialized, high-speed network that provides block-level network access to storage. SANs are typically composed of hosts, switches, storage elements, and storage devices that are interconnected using a variety of technologies, topologies, and protocols. SANs may also span multiple sites. SANs are often used to ⎯ improve application availability (e.g., multiple data paths), ⎯ enhance application performance (e.g., off-load storage functions, segregate networks, etc.), Fibre Channel Security SNIA Technical White Paper 5 May 20, 2016 ⎯ increase storage utilization and effectiveness (e.g., consolidate storage resources, provide tiered storage, etc.), and ⎯ improve data protection and security. In addition, SANs typically play an important role in an organization's Business Continuity Management (BCM)1 activities. A SAN presents storage devices to a host such that the storage appears to be locally attached. This simplified presentation of storage to a host is accomplished through the use of different types of virtualization. SANs are commonly based on Fibre Channel (FC) technology2 that utilizes the Fibre Channel Protocol (FCP) for open systems and proprietary variants for mainframes. In addition, the use of Fibre Channel over Ethernet (FCoE) makes it possible to move FC traffic across existing high- speed Ethernet infrastructure and converge storage and IP protocols onto a single cable. Other technologies like Internet Small Computing System Interface (iSCSI), commonly used in small and medium sized organization as a less expensive alternative to FC, and InfiniBand, commonly used in high performance computing environments, can also be used. In addition, it is possible to use gateways to move data between different SAN technologies. 2.2 Fibre Channel (FC) According to the SNIA Dictionary, Fibre Channel is A serial I/O interconnect capable of supporting multiple protocols, including access to open system storage (FCP), access to mainframe storage (FICON), and networking (TCP/IP). It supports point to point, arbitrated loop, and switched topologies with a variety of copper and optical links running at a variety of speeds. The Fibre Channel Protocol (FCP) is described in ANSI INCITS 470–2011 (FC-FS-3) as a network architecture organized into five layers or levels. The following table provides a brief summary for each of the levels: 1 "Business Continuity Management (BCM)" is used in ISO/IEC 27002:2013 to cover topics such as Disaster Recovery (DR) and the broader issue of Business Continuity (BC). In the past, DR and BC were addressed differently by the security community, but the current trend is to handle them as elements under BCM. 2 SANs that are based on the Fibre Channel switched fabric (FC-SW) topology are sometimes referred to as FC fabrics. Fibre Channel Security SNIA Technical White Paper 6 May 20, 2016 FC-4 Protocol-mapping layer (application protocols, such as SCSI, IP or FICON, are encapsulated into a protocol data unit for delivery to FC-2) FC-3 Common services layer FC-2 Network layer (core of Fibre Channel, and defines the main protocols) FC-1 Data link layer (implements line coding of signals) FC-0 Physical layer (cabling,