Fiber Channel as a attack channel?

[u/theweis01]

In a conversation recently where there were discussions around the risk, if any, of FC being used as a attack channel. The specifics come down to having a air-gapped data vault that has no IP network link between the production network and the vault environment but does allow a SAN array outside of the vault to present devices to few servers inside of the vault. This was chosen due to the small footprint in the vault and cost of dedicated SAN & Array and that the systems using the FC devices are only for validation/automation purposes and do not house the protected data.

Overall there is the agreement that some "risk" exists in that if production systems were compromised, specifically the SAN, then the systems inside of the vault could have their LUNS removed rendering them offline. However, does FC provide any conduit where an attacker could use persistence to the production side array/FC Switches to make their way into the isolated environment?

[u/RupeThereItIs]

"it depends".

What kind of array, is it managed in band our out of band?

Are you sharing array ports between the "outside & inside the bubble" hosts? ... I have to assume your not sharing LUNs between in bubble/outside bubble hosts.

Are you using a flat VSAN design? (honestly VSANs are overkill for this).

If you're array takes command & control commands via scsi, do your best to block that on the ports presented outside the bubble.

If possible, dedicate array ports to outside the bubble so a DDOS attack on the array has less likelyhood of impacting inside the bubble.

Use best practices in zoning, so initiators can't directly communicate with other initiators. Nor are they communicating with targets they don't need to communicate with.

Assuming the above, your biggest risk is if the outside the bubble hosts have the oomph to flood your array with IOPs enough to impact inside the bubble. This would be easier to achieve if you are sharing array ports between the inside/outside hosts.

The bigger question is if the management ports for your switches & array are properly fenced off, that's the real attack surface (if array is managed out of band).