How to Finally Secure your Network Storage Himanshu Dwivedi Managing Security Architect

How to Finally Secure your
Network Storage
Himanshu Dwivedi
Managing Security Architect
@stake, Inc.
•
Why
is
SAN
Security
Needed
Information
– Unauthorized access or unintentional damage
• Protection
– Internal and External Threats
• Competitors, ex-employees, future ex-employees, etc.
• Connectivity
– SANs include all types of servers (Application, Web,
FTP, etc) that are attached to the Ethernet and the
existing storage network
– A single compromised server may open the gateway to
the SAN
Importance of SAN Security
• Importance
– What we see: Clients dedicating large budgets to SANs
• Protect intellectual property
• SANs typically contain the keys to the kingdom
– What we know: Attacks rarely change, they get
modified
• Management methods/networks are the primary target
• IP attacks will be used for Fibre Channel
– What vendors know:
• “Many SANs are only as secure as the hosts and clients attached
to the storage network” --Scott Robinson, CTO, Datalink Corp
Example SAN
Common Problems Authentication
• Limited access control
– Limited concept of multi-user administration
• Management tools do not provide a variety of
security profiles
• Authentication Vulnerabilities
– Username/Password is not enough!
– Cisco Vulnerability: It is possible to read stored
configuration files from the Storage Router
without any authorization
Common Problems – Clear-text
• Fibre Channel management
– SCSI Enclosure Services (SES)
• SES provides no extra security besides username/password
– FC-SNMP
• SNMP is clear-text and provides no extra security besides
community strings
– Browser-Based Management
• HTTP, SNMP, SES may be managed via a browser
• Username and password (pass in the clear), is the only security
provided
• Again….Username/Password is not enough!!
Fibre Channel Layers
Attack Vector: FC - Layer 2
Weaknesses - Sequence ID
• SEQ_CNT and SEQ_ID
– A Fibre Channel Sequence is a series of one or more
related frames transmitted unidirectionally from one
port to another.
– All frames must be part of a Sequence. Frames within
the same Sequence have the same SEQ_ID field in the
header.
• For each frame transmitted in a Sequence, SEQ_CNT is
incremented by 1.
– This is similar to what? – ISN in TCP/IP
– Attacker can guess the SEQ_ID and attempt to hijack
the session
Weakness - Joining the Fabric
• Pollute SNS when joining the fabric
– N_Port send a Fabric login (FLOGI) to the well know
address of xFFFFFE (broadcast).
– The switch receives the frame at xFFFFFE and
returning an accept frame (ACC). Service information
is exchange
– Knowing there is no validation required to receive an
accept frame (ACC), an attacker could send a modified
24-bit address to xFFFFFE in an attempt to corrupt the
SNS information
• As soon as ACC is received, attacker knows that SNS has been
modified
Weakness - Flow control
• Disruption of Flow Control
– A device can transmit frames to another device only
when the other device is ready to accept them. Before
the devices can send data to each other, they must login
to each other and establish credit.
– Credit
• Credit refers to the number of frames a device can receive at a
time. This value is exchanged with another device during login,
so each knows how many frames the other can receive.
– Disruption of Flow control
• Injecting a high or low credit value disrupts the service
Weakness - Switches
• Cut-through switching
– A switch only looks at the D_ID (24-bit
Destination address) to route the frame
– Increases performance by reducing the time
required to make a routing decision
– However, there is no verification of the S_ID
(Source address) and the frame is passed
Weakness - Simple Name Server
• Simple Name Server
– Simple Name Servers maps the 24-bit fabric
address and the 64-bit World Wide Name
• IP Attack: Polluting the ARP tables
• Fibre Channel Attack: Polluting the SNS
Weakness - HBA
• World Wide Names
– WWNs can be easily changed on an HBA
– WWNs are used as unique identifiers that do
not get authenticated
– WWNs can be spoofed to access different
zones
LUN Masking and Zoning
• Switch Features
– LUNs Masking and Zoning
• LUN masking creates subsets of storage within the
SAN virtual pool and allows only designated servers
to access the storage subsets.
• Zoning restricts access to specific physical devices
such as RAID arrays or individual disks (Equivalent
to VLANs in the Ethernet world).
– LUN masking and Zoning are NOT considered
security tools, but rather efficiency tools
LUN Masking
• Types of LUN Masking
– Server configuration
– Host level drivers on HBA
– Storage controllers are configured
• Must be supported by the storage vendor
– Storage Virtualization – LUN Masking device
• Works with any server and any HBA, added
overhead and performance issues
LUN Masking
• Strengths
– Provides segregation
• Weaknesses
– Design for segmentation, not security
– Modifications at HBA are granted
– LUNs “broadcasting” is built to be highly
available
Zoning
• Zoning is separation
– A method for separating fabric connected devices in
group over the same physical fabric
– Similar to VLANs in the Ethernet world
• Types of Zoning
– Hard, Soft, and combination
– Hard
• Physical port address – static fabrics
– Soft
• Node WWN and Port WWN – dynamic fabrics
Hard Zoning
Zone 1:
Physcial
Port 1,2,3,4
Zone 2:
Physcial
Ports
5,6,7,9
1
2
3
7
9
Switch
HBA
WWW-a
HBA
WWW-b
HBA
WWW-c
HBA
WWW-d
HBA
WWW-e
Soft Zoning
Simple Name
Sever
Zone 1:
WWW-a
WWW-b
Switch
Zone 2:
WWW-c
WWW-d
WWW-e
HBA
WWW-a
HBA
WWW-b
HBA
WWW-c
HBA
WWW-d
HBA
WWW-e
Future Problems
• Ethernet attack techniques will soon be used for
FC
–
–
–
–
–
–
–
–
–
Man-in-the-Middle*
Replay
Spoofing*
Malformed Packets
Zone Hopping (VLAN hopping)
Cache Poisoning
Hijacked sessions*
Sniffing
Denial of Service
* Example to Follow
Future Attacks - MITM
• Man-in-the-Middle
– A attacker sends out a modified frame to xFFFFFE with
the 24-bit address of the legitimate switch. The fabric
assumes that the attacker is the legitimate fibre channel
switch
– All frames destined for the real switch are passed to the
attacker first, then to the legitimate switch.
• However, tools need to be written to to pass the traffic to the
switch, otherwise the attack will not work.
Future Attacks - MITM
• Man-in-the-Middle
Supposed interaction
HBA1
WWN
0038283xxxx
Management
Workstation
WWN
Fibre Channel 1018201xxxx
Switch
Actual interaction
Sends out 24bit address
of switch to xFFFFFE
Attacker
Future Attacks - Spoofing
• Spoofing
– A server is strictly given rights to zones from
the switch
• An attacker changes (spoofs) its WWN to the WWN
of the server
• The switch grants access rights to certain zones
because it is recognizes the WWN
Future Attacks - Spoofing
• Spoofing
Simple Name Server
WWN
Zone
9382108xxxx
1,4,6
0038283xxxx
2,5,9
Legitimate Interaction
HBA1
WWN
0038283xxxx
Fibre Channel
Switch
Server
Spoofed interaction
Attacker
HB2
takes
WWN 0038283xxxx
Legitimate
Spoofed
Future Attacks – Session
Hijacking
• Session Hijacking
– FC session hijacking could be conducted if a
third party takes control of an existing session
between two trusted machines by predicting the
Sequence ID (SEQ_CNT field) in FC-2
• In FC-2, the SEQ_CNT field identifies individual
frames within a Sequence. For each frame
transmitted in a Sequence, SEQ_CNT is
incremented by 1.
Future Attacks – Session
Hijacking
• Session Hijacking
Initial Interaction
Switch
Session Hijack
Trusted
Workstation
Attack Machine
Future Attacks – Switch Attacks
• Switch Attacks
– E-port to E-port replication!
SSP
What the switch thinks
Rogue Server
Simple Name Server
compromised!!!
Fibre Channel
Switch
Fibre Channel
Switch
E-port
Short Term Solutions
• Segmentation
– Logical segmentation of management traffic from data
traffic
– FC for data
– Ethernet of FC-IP for management (with IPSec)
– Create a separate SAN management network,
segmented from corporate/data network
• Traffic segmentation will limit exposure of other network
segments in the event that a segment is compromised.
• It ensures individuals who require access to one network
segment (e.g. management) cannot access other segments (e.g.
data); thus limiting access to business need.
Short Term Solutions
• Switch Configurations
– Simple Name Server (soft) Zoning and Hard Zoning
• Regular zoning, both hard zoning and simple name server (soft)
zoning, will be required on all switches. This will add a layer
of security for WWNs on all appropriate physical ports
– Port Binding (locking)
• Physical Port Binding enables only authorized WWNs to access
a particular port on each front-end switch and the secure fibre
switch. Fabric Membership Authorization
– Port-type Controls
• Port-type Controls will lock each port to a G-port, F-port, or Eport, according to their appropriate specifications.
Fibre Channel Solutions
• Fibre Channel Security
– Andiamo Systems, Cisco, EMC, Qlogic,
VERITAS
• Requirements
– Authentication (e.g. switch to switch)
– Integrity (e.g. data integrity)
– Encryption (e.g. ESP payload)
Fibre Channel Solutions
– FCSec
– Authentication and Encryption at the FC-2 Layer
– Provides:
• Switch to Switch Authentication
• Node to Switch Authentication
• Node to Node Secure Channel
– Defends:
• Spoofing
• Session Hijacking
• Man-in-the-Middle
– Monkey-in-the-Middle?
Fibre Channel Solutions
• FCSec
– AH and ESP over FC-2
– Authentication with AH will be once in a while,
meaning that overhead should be relatively low
– What are the bandwidth concerns?
Fibre Channel Solutions
• FCSec
– Switch to Switch Authentication
• After keys have been exchanged, frames exchanged between
the switches, will be authenticated to ensure data integrity
– SLAP (Switch Layer Authentication Protocol)
– SA is inserted in E_Port Frames
– Node to Switch Authentication
• After key exchange, two nodes can exchange frames to ensure
integrity
– Node to Node Secure Channel
• After key exchange, FC-2 frames can be encrypted with ESP
Fibre Channel Solutions
• Switch Solutions
• SLAP
– Switch Layer Authentication Protocol
• Security Associations between two E_Ports
• Provides Authentication
• Provides non-repudiation
– Developed by Brocade
• Currently in beta
Long Term Solutions
• Switch Configurations
– SLAP
• Switch Layer Authentication Protocol. Switch to switch
authentication via digital certificates and unique private keys
– Fabric Membership Authorization
• Fabric Membership Authorization incorporates an internal
database on each switch with a list of authorized WWNs that
may join the fabric.
– Fabric Configuration Servers
• This switch is the only device allowed to manage the other
switches. It uses its own database for authentication, rather
than SNMP or regular username/password combination.
Long Term Solutions
• Encryption of data in transit and in storage
– Encryption will facilitate data integrity and
confidentiality
– FCSec (Fibre Channel Security)
– Both Data and Management encrypted
• Authentication
– Certificate based authentication to fabric
• Switch to Switch and HBA to Switch
Conclusion
• What does it all mean?
– KNOW YOUR RISKS
Acceptable amount of risk
+
Different functionality
=
Secure SANs
Questions
• Himanshu Dwivedi
– [email protected]