Up until recently, security measures have been enforced at the perimeter, while ubiquitous deployments of remote access links and wireless networks were eroding the network boundaries thus defined. Recent worms history has clearly demonstrated the fact that the threat is now in the inside, and that the border defenses are getting circumvented. As this trend is not going to fade away, large networks must be somewhat domesticated to permit monitoring.

While Network Flow data, as exported by routers, were designed for accounting, they represent an efficient way to record transactions occurring on a network for real time or forensic analysis. This talk will focus on the security applications of Network Flows, and how they can be used to detect and analyze network misuses in corporate and service providers' networks.

The presentation will be a formal knowledge transfer session to discuss tactical methods and high-level strategies to adequately secure storage infrastructures.

The presentation will begin with a discussion on the several security issues associated with Fibre Channel Storage Area Networks (SANs). The session will highlight specific issues and flaws associated with storage and how attacks may expose critical vulnerabilities. The session will then progress to a discussion on the tactical methods and strategies to mitigate identified security problems.

The presentation will cover three to five security topics and specifically discuss a tactical solution for each of them. The standard and best practices discussed in the session will focus on authentication/authorization, segmentation, device configuration (lockdown), auditing/logging, and encryption. Each topic will be discussed along with a tactical security solution to fully describe the defensive measures that can protect against storage attacks.

Lastly, the session will highlight the effects of default settings on networks storage devices, such as SAN switches, which can negatively impact the security posture on storage infrastructures.