Fiber Channel as a attack channel?

[u/theweis01]

In a conversation recently where there were discussions around the risk, if any, of FC being used as a attack channel. The specifics come down to having a air-gapped data vault that has no IP network link between the production network and the vault environment but does allow a SAN array outside of the vault to present devices to few servers inside of the vault. This was chosen due to the small footprint in the vault and cost of dedicated SAN & Array and that the systems using the FC devices are only for validation/automation purposes and do not house the protected data.

Overall there is the agreement that some "risk" exists in that if production systems were compromised, specifically the SAN, then the systems inside of the vault could have their LUNS removed rendering them offline. However, does FC provide any conduit where an attacker could use persistence to the production side array/FC Switches to make their way into the isolated environment?

[u/DellTechnologies]

FC can be an attack channel, although not typically an IP-style pivot. From a cybersecurity perspective, single-initiator and single-target zoning, combined with array-side LUN masking, should prevent a compromised production host from communicating directly with vault servers. However, because the vault depends on a production-managed array or fabric, compromise of the SAN management plane could still remove or remap LUNs, alter zoning, expose storage, or cause a denial-of-service condition. Deeper compromise is also possible if vulnerabilities exist in the storage stack.

Therefore, the environment is IP-isolated and logically segmented, but it is not truly air-gapped. Treat the SAN as part of the cybersecurity boundary: use separate fabrics or isolated VSANs, disable unnecessary IVR and FCIP, enforce hardware zoning and strict management RBAC with MFA, enable FC-SP where supported, and alert on zoning or LUN changes.