Cybersecurity is a growing priority for organizations. With growing concerns, demands, and regulations, along with evidence of increasing attacks from local and global forces, the need to address evolving security requirements is obvious. Attackers are continually finding new creative techniques to infiltrate IT infrastructures to penetrate existing security measures. In addition to external threats, there is also the potential of insider threats where there is already access to infrastructure.

These threats to organizations have negative economic consequences:

• A cyber or ransomware attack occurs every 11 seconds.[1]
• 84 percent of IT leaders report data loss prevention is more challenging with a remote workforce.[2]
• More than 60 percent of companies have experienced a data compromise due to an exploited vulnerability.[3]
• The average cost of a cybercrime for an organization is $13M.[4]
• The total global impact of cybercrime is $6T.[5]

Financial cost is not the only loss incurred if a breach occurs. Loss of organizational reputation can be even more costly because its impact can extend over many years. The cost of a data breach can have lasting effects for organizations of all sizes and across all industries.

Dell Technologies takes a comprehensive approach to cyber resiliency with a framework that is designed to help organizations achieve their security objectives and requirements.

The Dell cybersecurity framework aligns with the National Institute of Standards and Technologies (NIST) cybersecurity framework and consists of the following areas Identify, Protect, Detect, Respond, Recover.

Dell PowerMax offers various data services and solutions to safeguard sensitive and mission-critical data.

[1] Estimated for 2021. Cybersecurity Ventures, Cybercrime to Cost the World $10.5 Trillion Annually by 2025.

[2] Tessian, The State of DLP - Why DLP Has Failed and What the Future Looks Like, May 2020.

[3] Forrester Consulting Thought Leadership Paper Commissioned by Dell, BIOS Security – The Next Frontier for Endpoint Protection, June 2019.

[4] Accenture, The State of Cybersecurity Resilience 2021.

[5] Estimated for 2021. Cybersecurity Ventures, Cybercrime to Cost the World $10.5 Trillion Annually by 2025.

Dell Technologies and the authors of this document welcome your feedback on this document. Contact the Dell Technologies team by email.

Author: Richard Pace

Note: For links to other documentation for this topic, see the PowerMax and VMAX Info Hub.

Dell follows a “shift-left” approach to security that ensures that security is baked into every process in the development life cycle. The Dell Secure Development Lifecycle (SDL) defines security controls based on industry standards that Dell product teams adopt while developing new features and functionality. Dell SDL includes both analysis activities and prescriptive proactive controls around key risk areas. 

We strive to help our customers minimize risk associated with security vulnerabilities in our products. Our goal is to provide customers with timely information, guidance, and mitigation options to address vulnerabilities. The Dell Product Security Incident Response Team (Dell PSIRT) is chartered and responsible for coordinating the response and disclosure for all product vulnerabilities that are reported to Dell. We employ a rigorous process to continually evaluate and improve our vulnerability response practices and regularly benchmarks those practices against the rest of the industry. Dell has an ingrained culture of security.

The following sections describe the various data services and solutions offered for Dell PowerMax arrays to provide robust security if a cyber-attack occurs.

Note: For more information about each topic, see References.

Dell follows a “shift-left” approach to security that ensures that security is baked into every process in the development life cycle. The Dell Secure Development Lifecycle (SDL) defines security controls based on industry standards that Dell product teams adopt while developing new features and functionality. Dell SDL includes both analysis activities and prescriptive proactive controls around key risk areas. 

We strive to help our customers minimize risk associated with security vulnerabilities in our products. Our goal is to provide customers with timely information, guidance, and mitigation options to address vulnerabilities. The Dell Product Security Incident Response Team (Dell PSIRT) is chartered and responsible for coordinating the response and disclosure for all product vulnerabilities that are reported to Dell. We employ a rigorous process to continually evaluate and improve our vulnerability response practices and regularly benchmarks those practices against the rest of the industry. Dell has an ingrained culture of security.

The following sections describe the various data services and solutions offered for Dell PowerMax arrays to provide robust security if a cyber-attack occurs.

Note: For more information about each topic, see References.

Dell TimeFinder SnapVX provides space-saving and efficient local replication in PowerMax arrays. SnapVX snapshots are a pointer-based structure that preserves a point-in-time view of a source volume. Snapshots provide the ability to manage consistent point-in-time copies for storage groups and are created with a user-defined name and optional expiration date (time-to-live), and without the use of a target volume. Host-accessible target volumes can be linked if a point-in-time snapshot needs to be accessed. Writing to a linked target does not affect the point-in-time of the snapshot.

SnapVX snapshots can be set as secure snaps. Secure snaps are snapshots that cannot be deleted, accidentally or intentionally. They are retained in resource-limited situations in which conventional snapshots are placed in a failed state to release resources.

Secure snaps must be created with a time-to-live retention period. The snapshot cannot be terminated before the retention time, and all termination attempts are rejected. When the retention time is reached, the snapshot is terminated.

The retention period on a secure snap can be extended in situations where the snapshot is needed longer than originally planned; however, reducing the retention time is not allowed. A traditional snapshot can be converted to a secure snap, but a secure snap cannot be converted to a traditional snapshot. All other SnapVX operations and rules apply to secure snaps. 

When implementing secure snaps, a user should determine how many snapshots on an array must be secure. Users should consider using secure snaps only on certain critical volumes, or only on a subset of the snapshots to capture points-in-time that are critical to the business and for how long the secure snaps should be retained. As always, proper planning and system sizing is crucial, no matter the types or number of snapshots that will exist in an environment.

The following figure shows an example of creating secure snaps with a retention time of five days.

Figure 1.        Secure snap creation

Dell AIOps is a cloud-based application that provides proactive monitoring and predictive analytics for PowerMax arrays. Each customer is provided with an independent, secure portal in which users can register their PowerMax arrays and monitor their storage from a single portal. This secure portal ensures that each customer will only be able to see arrays in their environment.

Cybersecurity in Dell AIOps monitors and compares the configuration of the PowerMax system to a set of user-selected, security-related evaluation tests. Upon identifying a deviation between the actual and desired configuration setting, CloudIQ proactively notifies users of the violation and provides remediation steps to correct the issue. Based on NIST 800-53 R5 standards and Dell best practices, Cybersecurity in Dell AIOps quickly and automatically ensures that the storage infrastructure is secure, to comply with the industry’s best practices.

Cybersecurity in Dell AIOps can be set to provide proactive notifications to the user in the event of an infrastructure security risk. The Security Advisories section of the Cybersecurity feature notifies users of relevant Dell and Security Advisories. Users quickly see a summary of vulnerabilities specific to their systems and versions along with links to remediation details.

Dell AIOps uses machine learning and predictive analytics to identify any anomalies.

• Performance metrics are compared with historical values to determine any deviation outside of normal ranges.
• Performance impacts are also analyzed to identify any increases in latency against other metrics, such as IOPS and bandwidth. The analysis is designed to determine if the latency increase is caused by workload characteristics or any other competing resource, and to identify the origin of the impact. 
• Capacity anomaly detection uses hourly analysis of usage to identify any surges of capacity utilization.

The following figure shows an example of latency anomaly detection.

Figure 3.        Dell AIOps latency anomaly

System Risk

System Risk is the multisystem view for cybersecurity. This page displays all systems that are enabled for cybersecurity along with the risk level, percentage of tests enabled in the Evaluation Plan, and summary of Issues. For systems that have an active ransomware incident, Dell AIOps displays a red ransomware incident banner in the card view. The Risk Level provides an overall assessment for the system based on the enabled evaluation tests, and has one of the following values:

• Normal

• No active Cybersecurity issues.

• Low

• One or two active Low severity Cybersecurity issues.
• There are at least five enabled tests and the number of enabled tests is greater than 70%.

• Medium

• One to five active non-High severity Cybersecurity issues with at least one being Medium and number of enabled tests greater than five.
• Greater than two active Low severity Cybersecurity issues and the number of enabled tests is greater than five.

• High

• One or more active High severity Cybersecurity issues and the number of enabled tests is greater than five.
• More than five non-High active issues where at least one issue is Medium severity and the number of enabled tests is greater than five.

• Unknown

• Evaluation Plan is disabled.
• The number of enabled tests is less than or equal to five.
• There are no active Cybersecurity issues and the number of enabled tests is less than 70%.
• There are one or two active Low severity Cybersecurity issues and the number of enabled tests is less than 70%.

The following figure shows the System Risk page:

Figure 4.        Cybersecurity System Risk page in Dell AIOps

Misconfigurations

Misconfigurations provides an overall listing of cybersecurity issues that have been identified in the environment. The Active tab lists out all active issues and provides the severity, issue name, associated system, and when it was created. Expanding the issue provides the issue description and the recommended remediation, creation timestamp, security control family, and evaluation test. The Resolved tab lists out all issues that have been corrected and the timestamp for when the issue was resolved.

The following figure shows the Misconfigurations page:

Figure 5.        Cybersecurity Misconfigurations page in Dell AIOps

Policy

Policy is where users enable, disable, and configure the tests in the Evaluation Plan. This can be done by creating individual evaluation plans for each system or by creating a template and applying it to multiple systems.

The Policy page lists the cybersecurity enabled systems. It also includes information such as the associated template, status of the evaluation, number of selected tests, custom tags, and the last time the evaluation plan was updated. Cybersecurity admins can assign or unassign templates to systems, enable or disable the evaluation plan for systems, or edit the evaluation plan for an individual system.

The following figure shows the Policy page

Figure 6.        Policy page of Cybersecurity in Dell AIOps

Policies can be edited to add and remove tests from the evaluation plan to set a policy for each individual system. The possible evaluation tests are listed and grouped by Security Control Family (based on NIST 800-53 R5). Each test can be selected or cleared for inclusion in the Evaluation Plan. Selecting the Details icon provides a detailed description of the test.

The following figure shows the Evaluation Plan edit screen:

Figure 7.        Evaluation Plan for Cybersecurity Policy

Security Advisories

Security Advisories provides a full list of applicable security advisories along with their impact, a synopsis, component, number of impacted systems, and publish date. Clicking the View Article hyperlink opens the article details on the Dell support page.

Clicking the Advisory ID hyperlink opens a window providing a list of all affected systems, affected component, and current version of that component. This window also shows additional information about the security advisory including the list of Common Vulnerabilities and Exposures (CVEs) addressed by the security advisory. There is also capability to export the security advisories to a CSV file.

The following figure shows the Security Advisories:

Figure 8.        Security Advisories in Cybersecurity of Dell AIOps

Ransomware Incidents

Ransomware Incidents enables PowerMax users to identify cybersecurity ransomware incidents in near real time.

Ransomware attacks are typically encoded user data using asymmetrical encryption. Since encrypted data is nonreducible, PowerMax systems can use Dell AIOps to monitor and analyze data reduction data. When enabled on a storage group, ransomware incidents will enter a learning phase where it will analyze data patterns and establish an expected range of reducible/unreducible data. Once the 2-week learning phase is complete the storage group will switch to the detecting phase. When the Increases in the amount of unreducible data can represent suspicious activity or a potential ransomware threat. Proactive alerts can be set to notify users of the increased unreducible data that could represent data being encrypted, which would provide early detection that could minimize exposure.

The Ransomware Incidents page shows all identified incidents and puts them in one of three categories: New, Investigate, or Closed. When an incident is first identified, it appears in the New tab. Each incident has an incident ID, a confidence level, the system identifier, the location, the number of affected storage groups, and the created and updated times. There is also the ability to add notes to each incident. When the incident is ready to be analyzed, the user can select it and click Acknowledge & Investigate.

The following figure shows the Ransomware Incidents page:

Figure 9.        Ransomware Incidents main page

Note: At the time of this publication, the Ransomware Incidents feature is considered Beta. Support and feedback are accomplished through the feedback form link in the main page.

Once the incident is under investigation, any new anomalies will trigger a new incident. While in the investigate state, the user can look at the potentially affected hosts and applications to determine if the incident is a true ransomware attack.

To help investigate, users can click the incident ID link and see the details of which storage groups experienced anomalies and when the anomalies were created and last updated.

The following figure shows an incident under investigation:

Figure 10.    Incident under investigation

Within the investigation screen, the user can view the storage group metrics. The metrics contain charts of the reducible data, historic seasonality, and anomalies. Up to three storage groups can be viewed at once.

The following figure shows the storage group metrics:

Figure 11.    Storage group metrics

The Anomalies tab provides a list of each identified reducible data anomaly with timestamps.

The following figure shows the reducible data anomalies:

Figure 12.    Anomalies tab within a ransomware incident

Once the investigation is complete, the user determines if the incident was a valid ransomware attack that was resolved or a false incident. Selecting an incident and then clicking Close gives the user the option to close it with either of the two options.

The following figure shows closing an incident:

Figure 13.    Closing a ransomware incident.

See Appendix B: Ransomware Incident Management Troubleshooting Guide for more information or in event there may be suspicion of a ransomware event.

Dell AIOps is a cloud-based application that provides proactive monitoring and predictive analytics for PowerMax arrays. Each customer is provided with an independent, secure portal in which users can register their PowerMax arrays and monitor their storage from a single portal. This secure portal ensures that each customer will only be able to see arrays in their environment.

Cybersecurity in Dell AIOps monitors and compares the configuration of the PowerMax system to a set of user-selected, security-related evaluation tests. Upon identifying a deviation between the actual and desired configuration setting, CloudIQ proactively notifies users of the violation and provides remediation steps to correct the issue. Based on NIST 800-53 R5 standards and Dell best practices, Cybersecurity in Dell AIOps quickly and automatically ensures that the storage infrastructure is secure, to comply with the industry’s best practices.

Cybersecurity in Dell AIOps can be set to provide proactive notifications to the user in the event of an infrastructure security risk. The Security Advisories section of the Cybersecurity feature notifies users of relevant Dell and Security Advisories. Users quickly see a summary of vulnerabilities specific to their systems and versions along with links to remediation details.

Dell AIOps uses machine learning and predictive analytics to identify any anomalies.

• Performance metrics are compared with historical values to determine any deviation outside of normal ranges.
• Performance impacts are also analyzed to identify any increases in latency against other metrics, such as IOPS and bandwidth. The analysis is designed to determine if the latency increase is caused by workload characteristics or any other competing resource, and to identify the origin of the impact. 
• Capacity anomaly detection uses hourly analysis of usage to identify any surges of capacity utilization.

The following figure shows an example of latency anomaly detection.

Figure 3.        Dell AIOps latency anomaly

System Risk

System Risk is the multisystem view for cybersecurity. This page displays all systems that are enabled for cybersecurity along with the risk level, percentage of tests enabled in the Evaluation Plan, and summary of Issues. For systems that have an active ransomware incident, Dell AIOps displays a red ransomware incident banner in the card view. The Risk Level provides an overall assessment for the system based on the enabled evaluation tests, and has one of the following values:

• Normal

• No active Cybersecurity issues.

• Low

• One or two active Low severity Cybersecurity issues.
• There are at least five enabled tests and the number of enabled tests is greater than 70%.

• Medium

• One to five active non-High severity Cybersecurity issues with at least one being Medium and number of enabled tests greater than five.
• Greater than two active Low severity Cybersecurity issues and the number of enabled tests is greater than five.

• High

• One or more active High severity Cybersecurity issues and the number of enabled tests is greater than five.
• More than five non-High active issues where at least one issue is Medium severity and the number of enabled tests is greater than five.

• Unknown

• Evaluation Plan is disabled.
• The number of enabled tests is less than or equal to five.
• There are no active Cybersecurity issues and the number of enabled tests is less than 70%.
• There are one or two active Low severity Cybersecurity issues and the number of enabled tests is less than 70%.

The following figure shows the System Risk page:

Figure 4.        Cybersecurity System Risk page in Dell AIOps

Misconfigurations

Misconfigurations provides an overall listing of cybersecurity issues that have been identified in the environment. The Active tab lists out all active issues and provides the severity, issue name, associated system, and when it was created. Expanding the issue provides the issue description and the recommended remediation, creation timestamp, security control family, and evaluation test. The Resolved tab lists out all issues that have been corrected and the timestamp for when the issue was resolved.

The following figure shows the Misconfigurations page:

Figure 5.        Cybersecurity Misconfigurations page in Dell AIOps

Policy

Policy is where users enable, disable, and configure the tests in the Evaluation Plan. This can be done by creating individual evaluation plans for each system or by creating a template and applying it to multiple systems.

The Policy page lists the cybersecurity enabled systems. It also includes information such as the associated template, status of the evaluation, number of selected tests, custom tags, and the last time the evaluation plan was updated. Cybersecurity admins can assign or unassign templates to systems, enable or disable the evaluation plan for systems, or edit the evaluation plan for an individual system.

The following figure shows the Policy page

Figure 6.        Policy page of Cybersecurity in Dell AIOps

Policies can be edited to add and remove tests from the evaluation plan to set a policy for each individual system. The possible evaluation tests are listed and grouped by Security Control Family (based on NIST 800-53 R5). Each test can be selected or cleared for inclusion in the Evaluation Plan. Selecting the Details icon provides a detailed description of the test.

The following figure shows the Evaluation Plan edit screen:

Figure 7.        Evaluation Plan for Cybersecurity Policy

Security Advisories

Security Advisories provides a full list of applicable security advisories along with their impact, a synopsis, component, number of impacted systems, and publish date. Clicking the View Article hyperlink opens the article details on the Dell support page.

Clicking the Advisory ID hyperlink opens a window providing a list of all affected systems, affected component, and current version of that component. This window also shows additional information about the security advisory including the list of Common Vulnerabilities and Exposures (CVEs) addressed by the security advisory. There is also capability to export the security advisories to a CSV file.

The following figure shows the Security Advisories:

Figure 8.        Security Advisories in Cybersecurity of Dell AIOps

Ransomware Incidents

Ransomware Incidents enables PowerMax users to identify cybersecurity ransomware incidents in near real time.

Ransomware attacks are typically encoded user data using asymmetrical encryption. Since encrypted data is nonreducible, PowerMax systems can use Dell AIOps to monitor and analyze data reduction data. When enabled on a storage group, ransomware incidents will enter a learning phase where it will analyze data patterns and establish an expected range of reducible/unreducible data. Once the 2-week learning phase is complete the storage group will switch to the detecting phase. When the Increases in the amount of unreducible data can represent suspicious activity or a potential ransomware threat. Proactive alerts can be set to notify users of the increased unreducible data that could represent data being encrypted, which would provide early detection that could minimize exposure.

The Ransomware Incidents page shows all identified incidents and puts them in one of three categories: New, Investigate, or Closed. When an incident is first identified, it appears in the New tab. Each incident has an incident ID, a confidence level, the system identifier, the location, the number of affected storage groups, and the created and updated times. There is also the ability to add notes to each incident. When the incident is ready to be analyzed, the user can select it and click Acknowledge & Investigate.

The following figure shows the Ransomware Incidents page:

Figure 9.        Ransomware Incidents main page

Note: At the time of this publication, the Ransomware Incidents feature is considered Beta. Support and feedback are accomplished through the feedback form link in the main page.

Once the incident is under investigation, any new anomalies will trigger a new incident. While in the investigate state, the user can look at the potentially affected hosts and applications to determine if the incident is a true ransomware attack.

To help investigate, users can click the incident ID link and see the details of which storage groups experienced anomalies and when the anomalies were created and last updated.

The following figure shows an incident under investigation:

Figure 10.    Incident under investigation

Within the investigation screen, the user can view the storage group metrics. The metrics contain charts of the reducible data, historic seasonality, and anomalies. Up to three storage groups can be viewed at once.

The following figure shows the storage group metrics:

Figure 11.    Storage group metrics

The Anomalies tab provides a list of each identified reducible data anomaly with timestamps.

The following figure shows the reducible data anomalies:

Figure 12.    Anomalies tab within a ransomware incident

Once the investigation is complete, the user determines if the incident was a valid ransomware attack that was resolved or a false incident. Selecting an incident and then clicking Close gives the user the option to close it with either of the two options.

The following figure shows closing an incident:

Figure 13.    Closing a ransomware incident.

See Appendix B: Ransomware Incident Management Troubleshooting Guide for more information or in event there may be suspicion of a ransomware event.

Snapshot policies provide automated scheduling of SnapVX snapshots on PowerMax arrays. Policies are customizable with rules that specify when to take snapshots, how many to take, and how long to keep them. Compliance requirements can also be specified to send alerts if the rules of a policy are not being met. Snapshot policies create and retain snapshots according to the rules of each policy. Snapshot policies support up to 1,024 snapshots per source device and 65 million snapshots per PowerMax array.

Snapshot policies are applied to storage groups (SGs) to protect applications with consistent regularly scheduled snapshots. Applications can be protected by multiple policies with differing schedules and retention parameters, according to requirements. A single policy can protect multiple applications. Manual snapshots are supported along with snapshot policies to satisfy any on-demand requirements.

Parameters defined within each policy are as follows:

• Policy Name—One to 32 characters containing letters, numbers, dashes, and underscores
• Policy Type—Local or cloud
• Snapshot Type—Traditional or secure
• Recovery Point Objective—Interval or offset
• Snapshots to Keep—Timeframe or snapshot count
• Compliance Alerting—Based on snapshot count and scheduled interval

Note: All parameters are defined during creation and can be changed on active policies except for Policy Type and Secure Snaps options.

The following figure shows an example of creating a snapshot policy.

Figure 2.        Snapshot policy

See Appendix A: Mitigating ransomware attacks using Snapshot Policies for more information on how to leverage secure snaps with snapshot policies for ransomware protection.

PowerMax 2500 and 8500 arrays use device level monitoring to detect unusual IO patterns. These pattern deviations could be an indication of a ransomware attack.

The following IO patterns are being monitored:

• Track Flip (FLIP) - An existing track that is reducible is re-written as unreducible.
• Write after read (WAR) - Write to cache where the data was already in cache and been brought there by a read.

AI anomaly detection learns a normal FLIP and WAR rate for each device. If there is a significant deviation outside the normal, an event will be posted in the symevent log.  These events in the symevent log are searchable using the symevent Solutions Enabler command.

The following figure shows an example of the output of the symevent command.

Figure 14.    Symevent log output

PowerMax 2500 and 8500 arrays use device level monitoring to detect unusual IO patterns. These pattern deviations could be an indication of a ransomware attack.

The following IO patterns are being monitored:

• Track Flip (FLIP) - An existing track that is reducible is re-written as unreducible.
• Write after read (WAR) - Write to cache where the data was already in cache and been brought there by a read.

AI anomaly detection learns a normal FLIP and WAR rate for each device. If there is a significant deviation outside the normal, an event will be posted in the symevent log.  These events in the symevent log are searchable using the symevent Solutions Enabler command.

The following figure shows an example of the output of the symevent command.

Figure 14.    Symevent log output

Dell Unisphere for PowerMax uses authentication authority for multi-factor authentication (MFA) with Dell SecurID. SecurID provides time-sensitive tokens that are combined with a user password to verify identity during the authentication process.

Unisphere for PowerMax authenticates SecurID Authentication Manager with the SecurID token. If SecurID Authentication Manager validates the token, Unisphere for PowerMax then authenticates against Local Directory, Windows Active Directory, or LDAP for two-factor authentication.

MFA with SecurID is supported on all PowerMax arrays using external management with the following versions:

• SecurID Authentication Manager 8.5.0 OVA
• Unisphere 10
• Solutions Enabler 10

The following figure shows the settings for enabling MFA with SecurID:

Figure 15.    Enabling MFA with SecurID

YubiKey is a physical hardware device that is used for authentication and one-time passwords for MFA on configured devices. It provides a unique cryptographic key that is combined with a user password to verify identity during the authorization process.

YubiKey can be integrated with Unisphere for PowerMax for enhanced security through MFA. Once a Unisphere user account is registered with a YubiKey, the user password and YubiKey key are used for authorization. Unisphere verifies the cryptographic key from YubiKey and authenticates against Local Directory, Windows Active Directory, or LDAP for two-factor authentication.

YubiKey MFA is supported on the following storage arrays:

• PowerMax 2500/8500 with embedded and external Unisphere 10.2
• PowerMax 2000/8000 with 10.2 based external Unisphere

The following figure shows configuring YubiKey in Unisphere:

Figure 16.    Registering YubiKey with Unisphere

Note: YubiKey and RSA MFA are mutually exclusive and cannot be used together.

Dell Unisphere for PowerMax uses authentication authority for multi-factor authentication (MFA) with Dell SecurID. SecurID provides time-sensitive tokens that are combined with a user password to verify identity during the authentication process.

Unisphere for PowerMax authenticates SecurID Authentication Manager with the SecurID token. If SecurID Authentication Manager validates the token, Unisphere for PowerMax then authenticates against Local Directory, Windows Active Directory, or LDAP for two-factor authentication.

MFA with SecurID is supported on all PowerMax arrays using external management with the following versions:

• SecurID Authentication Manager 8.5.0 OVA
• Unisphere 10
• Solutions Enabler 10

The following figure shows the settings for enabling MFA with SecurID:

Figure 15.    Enabling MFA with SecurID

YubiKey is a physical hardware device that is used for authentication and one-time passwords for MFA on configured devices. It provides a unique cryptographic key that is combined with a user password to verify identity during the authorization process.

YubiKey can be integrated with Unisphere for PowerMax for enhanced security through MFA. Once a Unisphere user account is registered with a YubiKey, the user password and YubiKey key are used for authorization. Unisphere verifies the cryptographic key from YubiKey and authenticates against Local Directory, Windows Active Directory, or LDAP for two-factor authentication.

YubiKey MFA is supported on the following storage arrays:

• PowerMax 2500/8500 with embedded and external Unisphere 10.2
• PowerMax 2000/8000 with 10.2 based external Unisphere

The following figure shows configuring YubiKey in Unisphere:

Figure 16.    Registering YubiKey with Unisphere

Note: YubiKey and RSA MFA are mutually exclusive and cannot be used together.

PowerMax Single sign-on (SSO) authentication enables logging in to multiple devices or sites with one set of credentials. With Unisphere for PowerMaxOS 10.3, Microsoft Entra ID SSO is supported, with OpenID Connect (OIDC) authorization code flow.

Enabling EntraID SSO also activates OIDC access token authentication for REST API. After the access token is validated, Unisphere performs a cryptographic verification to ensure that the token is bound to the intended service. To support this verification, the token must include a specific claim, called the Access Token Authentication Claim, with a predefined expected value that is configured during setup. The EntraID Administrator must provide this claim information to the Unisphere security administrator.

When SSO is successfully enabled, the Unisphere login page allows credential-free login by enabling the OK button, even if the username and password are not provided. After clicking OK, the user is redirected to the IdP for authentication and is then redirected back to Unisphere only on successful authentication, that is based on the IdP authentication methods that are enabled for this OIDC client ID.

Note: SSO should not be enabled if native RSA SecurID or Yubikey are also enabled. The Entra ID Identity Provider (IdP) administrator can still enable any MFA authentication methods.

The following figure shows enabling SSO.

Figure 17.    Enabling SSO

PowerMax Single sign-on (SSO) authentication enables logging in to multiple devices or sites with one set of credentials. With Unisphere for PowerMaxOS 10.3, Microsoft Entra ID SSO is supported, with OpenID Connect (OIDC) authorization code flow.

Enabling EntraID SSO also activates OIDC access token authentication for REST API. After the access token is validated, Unisphere performs a cryptographic verification to ensure that the token is bound to the intended service. To support this verification, the token must include a specific claim, called the Access Token Authentication Claim, with a predefined expected value that is configured during setup. The EntraID Administrator must provide this claim information to the Unisphere security administrator.

When SSO is successfully enabled, the Unisphere login page allows credential-free login by enabling the OK button, even if the username and password are not provided. After clicking OK, the user is redirected to the IdP for authentication and is then redirected back to Unisphere only on successful authentication, that is based on the IdP authentication methods that are enabled for this OIDC client ID.

Note: SSO should not be enabled if native RSA SecurID or Yubikey are also enabled. The Entra ID Identity Provider (IdP) administrator can still enable any MFA authentication methods.

The following figure shows enabling SSO.

Figure 17.    Enabling SSO

Ignition key eliminates data exposure on D@RE enabled PowerMax arrays in the event physical security of the array is not guaranteed. The ignition key functionality requires authorization from an external key manager to gain access to the array. This prevents usage of the PowerMax unless the ignition key is retrievable from the external key manager during a power cycle. 

During every power cycle, with ignition key enabled, there is a handshake between PowerMax and the external key manager to bring the array online. Without this handshake, the array will remain offline.

Supported on:

• PowerMax 2500 and 8500
• PowerMax 2000 and 8000

Requirements:

• D@RE must be enabled
• HashiCorp Vault must be the external key manager

Note: Ignition key is enabled and disabled by RPQ only.

Ignition key eliminates data exposure on D@RE enabled PowerMax arrays in the event physical security of the array is not guaranteed. The ignition key functionality requires authorization from an external key manager to gain access to the array. This prevents usage of the PowerMax unless the ignition key is retrievable from the external key manager during a power cycle. 

During every power cycle, with ignition key enabled, there is a handshake between PowerMax and the external key manager to bring the array online. Without this handshake, the array will remain offline.

Supported on:

• PowerMax 2500 and 8500
• PowerMax 2000 and 8000

Requirements:

• D@RE must be enabled
• HashiCorp Vault must be the external key manager

Note: Ignition key is enabled and disabled by RPQ only.

PowerMax cyber vault offers a simplified orchestrated cyber recovery solution that is built using SRDF and snapshot technologies.

The basic cyber vault operating model connects production and secondary PowerMax arrays. The secondary array, which is an isolated PowerMax storage array, is known as the vault. The connection between the arrays is closed, creating an operational air gap and removing access to the vault array devices.

PowerMax cyber vault provides a secure copy of production data in the vault based on a policy. The air gap is opened periodically to push production snapshots to the vault using SRDF's adaptive copy mode. An immutable secure copy with a retention lock is created. The air gap is closed when the secure snapshot copy is taken on the vault. The snapshot pushes from the production system to the vault are incremental.

If a cyberattack occurs at the production site, secure copies at the vault site are used to recover the data or can be used directly from the vault. The vault maintains multiple copies of the production data based on the policy.

The cyber vault solution features include:

• Automated operations leveraging an automation and orchestration engine:

• Turn on ports to connect arrays 
• Close air gap and allow array transmission 
• Take snapshot on Production array and link source volume 
• Start replication 
• Suspend replication when complete 
• Take snapshot of copied data on vault array 
• Shut down ports 
• Open air gap and close transmission 

• Secure snaps in vault 
• Support for up to 16 storage groups

The cyber vault suite is installed and configured on an external vault host, which can be a server or virtual machine (VM). It has access to Dell Unisphere on the vault site and the production site. The cyber vault suite uses a REST API to communicate with Unisphere for all automation by using a policy managed by the cyber vault configuration file.

PowerMax cyber vault is supported on:

• PowerMax 2000/8000
• PowerMax 2500/8500
• Unisphere 9.2 or later

The following figure shows the PowerMax cyber vault solution architecture.

Figure 18.    PowerMax cyber vault architecture

Transport Layer Security (TLS) is a cryptographic protocol used to secure communications between communication application entities. PowerMax employs TLS protocols for management communication and data transfer to provide authentication, confidentiality, and data integrity.

Examples of PowerMax management applications that use TLS are:

• Solutions Enabler
• Unisphere
• VASA
• Data At Rest Encryption External Key Management
  • Key Trust Platform
  • Key Management Interoperability Protocol

TLS 1.3 is the latest protocol version and the standardized path and will be a requirement as per NIST SP 800-52.

PowerMax 2500 and 8500 arrays support TLS 1.3 available with PowerMaxOS 10.1 release.

PowerMax 2000 and 8000 arrays continue to support TLS 1.2 for interoperability purposes.

Transport Layer Security (TLS) is a cryptographic protocol used to secure communications between communication application entities. PowerMax employs TLS protocols for management communication and data transfer to provide authentication, confidentiality, and data integrity.

Examples of PowerMax management applications that use TLS are:

• Solutions Enabler
• Unisphere
• VASA
• Data At Rest Encryption External Key Management
  • Key Trust Platform
  • Key Management Interoperability Protocol

TLS 1.3 is the latest protocol version and the standardized path and will be a requirement as per NIST SP 800-52.

PowerMax 2500 and 8500 arrays support TLS 1.3 available with PowerMaxOS 10.1 release.

PowerMax 2000 and 8000 arrays continue to support TLS 1.2 for interoperability purposes.

Dell Data at Rest Encryption (D@RE) provides hardware-based, on-array, back-end encryption for PowerMax arrays. D@RE provides back-end encryption using IO modules that incorporate 256 AES-XTS data encryption and is FIPS 140-2 validated. The IO modules encrypt data as it is being written to the drives and decrypt the data as it is being read. All configured drives in the array are encrypted, including data and spare drives, using a unique Data Encryption Key (DEK).

D@RE can be deployed with either an embedded, set-it-and-forget-it key manager or with external key management.

With embedded key management, D@RE is integrated with Dell Key Trust Platform (KTP). Dell KTP establishes a pervasive and secure infrastructure for all key generation, distribution, and management capabilities required for D@RE.

The following figure shows the embedded key management architecture:

Figure 19.    Embedded key manager

External key management uses OASIS Key Management Interoperability Protocol (KMIP). KMIP allows for separation of key management from PowerMax arrays. An external key manager provides external centralized and consolidated key storage and management and allows integration between PowerMax arrays and the existing key management infrastructure.

The following figure shows the external key management architecture:

Figure 20.    External key manager

D@RE for PowerMax 2500 and 8500 provides full on-array, back-end encryption using Dell qualified, industry-standard self-encrypting drives (SEDs). SEDs are FIPS 140-2 and FIPS 140-3 validated as well as NVMe/TCG standard compliant. SEDs contain their own data encryption keys (DEKs) that are managed internally within the drives. Because the keys on the SED are self-managed, D@RE key management infrastructure generates and manages authentication keys (AKs), which are used to unlock the drives for reads and writes. 

D@RE incorporates Dell Key Trust Platform (KTP) for integrated, set-and-forget embedded key management. Dell KTP establishes a pervasive and secure infrastructure for all key generation, distribution, and management capabilities required for D@RE.

The following figure shows PowerMax 2500/8500 embedded key manager architecture:

Figure 21.    Embedded D@RE architecture

D@RE can also be deployed with an external key manager using OASIS Key Management Interoperability Protocol (KMIP). This provides external centralized key storage and management that simplifies key generation and recovery management for PowerMax and other KMIP-compatible encryption solutions.

The following figure shows PowerMax 2500/8500 external key manager architecture:

Figure 22.    External key manager architecture

Unisphere for PowerMax provides the capability for email alert notifications. With PowerMaxOS 10.3 release, these alerts can be set secure with Simple Mail Transfer Protocol Secure (SMTPS). SMTPS provides an additional layer of security by encrypting email messages, using TSLv1.2 (or later), and authenticating the identity of the mail server and email client.

Secure SMTP Authentication supports:

• Authenticated and non-authenticated mode
• SMTPS with username/password for client authentication to email server
• Multiple target email addresses
• Maximum of 20 destination email addresses
• Setting severities of Critical, Error, Warning, Notice, and Info

The following figure shows enabling secure alerts in Unisphere.

Figure 25.    Enabling secure alerts in Unisphere

Unisphere for PowerMax provides the capability for email alert notifications. With PowerMaxOS 10.3 release, these alerts can be set secure with Simple Mail Transfer Protocol Secure (SMTPS). SMTPS provides an additional layer of security by encrypting email messages, using TSLv1.2 (or later), and authenticating the identity of the mail server and email client.

Secure SMTP Authentication supports:

• Authenticated and non-authenticated mode
• SMTPS with username/password for client authentication to email server
• Multiple target email addresses
• Maximum of 20 destination email addresses
• Setting severities of Critical, Error, Warning, Notice, and Info

The following figure shows enabling secure alerts in Unisphere.

Figure 25.    Enabling secure alerts in Unisphere

Role Based Access Control (RBAC) gives administrators the ability to restrict management operations that users or groups of users can perform on PowerMax arrays. RBAC consists of various roles that define the operations that can be performed. Users can be assigned their own login and password with a single role or a combination of roles. Each role can further be restricted to specific storage groups.

RBAC is a hierarchy of roles, and each role has specific privileges:

• Administrator—Performs all operations
• Storage Administrator—Performs all management operations. Cannot perform security operations.
• Security Administrator—Performs all security operations
• Local Replication—Performs local replication operations involving snapshot creation. Device Manager is also required to restore a snapshot and only needed to link target devices. Secure snaps require Storage Administrator rights.
• Remote Replication—Performs SRDF operations involving device pairs. Create, modify, or deletion of SRDF groups requires Storage Administrator rights.
• Device Manager—Performs control and configuration operations on devices. Storage Administrator rights are required to create, expand, or delete devices.
• Performance Monitor—Can set performance alerts and thresholds
• Auditor—Grants the ability to view, but not modify, security settings. Minimum role to view audit logs.
• Monitor—Performs read-only operations excluding access to audit logs
• None—Has no permissions

The following figure shows the hierarchy of RBAC:

Figure 23.    RBAC role hierarchy

Shredder is a service that securely erases data prior to the decommissioning of a PowerMax system. The erasure has a validation process to verify that the data on the drives has been erased. The validation is a user input percentage value of the drive to verify. The array then validates the input percentage on all the drives and upon success generates a certificate. If any non-zero data is found, the process fails.

The following is an example of a Shedder certificate:

Figure 26.    Shredder certificate

Note: Shredder security standards require a Dell Professional Services engagement.  

Shredder is a service that securely erases data prior to the decommissioning of a PowerMax system. The erasure has a validation process to verify that the data on the drives has been erased. The validation is a user input percentage value of the drive to verify. The array then validates the input percentage on all the drives and upon success generates a certificate. If any non-zero data is found, the process fails.

The following is an example of a Shedder certificate:

Figure 26.    Shredder certificate

Note: Shredder security standards require a Dell Professional Services engagement.  

Tamper-proof audit logs are secure historical system records of all actions and operations performed on a PowerMax array. The secure logs are internal to the array itself and include information such as configuration changes, service operations, and security-relevant actions. The logs cannot be tampered with, modified, edited, or deleted by any user with any level of access.

 Relevant information recorded in the audit logs includes:

• Time and date of operation
• Operation type and category
• User and user type
• Hostname
• Application

The audit logs have advanced filtering and search capabilities. Filtering and searching can be done by specific timeframe as well as by the foregoing parameters to help determine what operation was performed, where the operation came from, and by whom the operation was performed.

Records can be expanded to show more detailed information and can be exported as a .log file.

The following figure shows an example of an audit log filtered by username and a searched action code of delete.

Figure 24.    Tamper-proof audit log

PowerMax 2500/8500 arrays use an immutable, silicon-based Hardware Root of Trust (HWRoT) to cryptographically affirm the integrity of BIOS and BMC firmware. This HWRoT is based on one-time programmable, read-only public keys provisioned by Dell in the factory to provide protection against malware tampering.

The BIOS boot process uses Intel Boot Guard technology, which verifies that the digital signature of the cryptographic hash of the boot image matches the signature stored in silicon by Dell in the factory. If Boot Guard successfully validates the signature, a chain of trust procedure validates the rest of the BIOS firmware modules until control is handed off to the operating system or hypervisor.

Each BIOS module contains a hash of the next module in the chain. The key modules in the BIOS are the Initial Boot Block (IBB), Security (SEC), Pre-EFI Initialization (PEI), Memory Reference Code (MRC), Driver Execution Environment (DXE), and Boot Device Selection (BDS). If Intel Boot Guard authenticates the IBB, the IBB validates SEC+PEI before handing control to it. SEC+PEI then validates PEI+MRC, which further validates the DXE+BDS modules. Validation of the DXE+BDS modules results in control being handed over to Unified Extensible Firmware Interface (UEFI) Secure Boot.

Rapid recovery to a trusted image is implemented on the PowerMax platform when authentication fails. The rapid recovery is essential within the HWRoT implementation and is automatically initiated by the BMC to guarantee maximum security and maintained uptime.

Secure Boot

Secure Boot represents an industry-wide standard for security in the preboot environment. Computer system vendors, expansion card vendors, and operating system providers collaborate on the specification to promote interoperability. Secure Boot is the process of verification that the image to be booted is exactly the image that is expected. It is used during Hardware Root of Trust, firmware load, and firmware upgrade. Secure Boot also extends through all the various images that need to be booted all the way, through the execution of the operating system image, such as bootloaders, to firmware to Initial BIOS to UEFI.

PowerMaxOS for PowerMax 2500/8500 supports industry standard UEFI Secure Boot, which checks the cryptographic signatures of UEFI drivers, kernels and other code loaded prior to the operating system running. UEFI Secure Boot prevents unsigned (untrusted) UEFI device drivers or operating system kernels from being loaded, displays error messages, and does not allow the device to function.

Measured Boot

Measured Boot is the process of storing hash values used for authentication during a Secure Boot sequence. Values are stored in the boot log within a Trusted Computing Group (TCG)-defined trusted platform module (TPM), public keys, and the various signatures. The TPM values can be used through a token process by an upstream operating system or applications to validate the expected execution of a Secure Boot process.

PowerMaxOS for PowerMax 2500/8500 supports two versions of TPM:

• TPM 2.0 FIPS + Common Criteria + TCG certified
• TPM 2.0 China certified

The TPM can be used to perform public key cryptographic functions and compute hash functions, and can generate, manage, and securely store keys.

PowerMax uses digital signatures on firmware updates for all components and subcomponents to assure that only authentic firmware is running on the platform. Secure firmware upgrade uses cryptographic authentication of digital signatures applied to the firmware bootloader and images of the running firmware before running any update process.

Enhanced firmware authentication is embedded within many third-party devices that provide signature validation using their own Root of Trust mechanisms. This prevents the possible use of a compromised third-party update tool from being used to load malicious firmware into, for example, a NIC or storage drive (and bypassing the use of signed Dell update packages). Many of the third-party PCIe and storage devices shipped with PowerMax use a hardware Root of Trust to validate their respective firmware updates.

If any firmware in any device is suspected of malicious tampering, administrators can roll back the platform firmware images to an earlier trusted version stored in PowerMax.

SnapVX snapshots with snapshot policies allow for 1,024 snapshots per source device and 65 million per PowerMax array. Users can take advantage of the frequency and large snapshot scale in policy-driven snapshots to provide enhanced data resiliency.

Because secure snaps cannot be maliciously or accidentally deleted before any planned expiration date, they can be used to preserve multiple point-in-time copies from which data can be recovered if a malware or ransomware attack occurs. Snapshot policies can be automated to take secure snaps with a high frequency and a short retention duration for fine granularity, with a lower frequency and longer retention for added security, or a mixture of both. If an attack occurs, the user can review the secure snaps to determine which point in time has the most relevant and up-to-date copy of data without malware impact. When the precise point in time is identified, restoring critical data can be done almost instantaneously by bringing application data back to the original state before any attack.

Secure snaps also provide an additional layer of security in the case of multiple attacks and can be used for forensic work to help determine what happened during the attack and when it originally occurred. With the lower frequency and longer retention period, secure snaps can be used to validate data and data change rate to help identify any suspicious activity.

Traditional snapshots can be set with a scheduling frequency rate and retention policy that works best for the organization. These snapshots can be used for daily business continuity, such as development, operations, and data analytics. They can also assist in any forensic analysis and can be compared against secure snaps to help determine what changed and when the change began. Unlike secure snaps, traditional snapshots can be deleted or fail in array resource constraint situations. However, the data on an existing snapshot cannot be changed and could be used for additional recovery options.

Both secure and traditional snaps are a powerful tool that can be used to help protect and restore data rapidly, to minimize any impact of a malware or ransomware attack. The large scalability of snapshots can be easily managed using snapshot policies for scheduling frequency and retention time duration to fit any size organization.

The following list is an operational example of the frequency, retention, and scale out of the value of SnapVX secure snaps. The numbers are based on an average of 5,000 production volumes in a PowerMax array.

• Secure snaps every 10 minutes with a 48-hour retention

• 288 per volume point-in-time copies
• Fine-grain protection and recovery

• Secure snaps every 60 minutes with a 7-day retention

• 168 per volume point-in-time copies
• Extended protection and data validation

Total = 2,040,000 secure point-in-time copies

Figure 27.    Frequency, retention, and scale out of secure snaps

SnapVX snapshots with snapshot policies allow for 1,024 snapshots per source device and 65 million per PowerMax array. Users can take advantage of the frequency and large snapshot scale in policy-driven snapshots to provide enhanced data resiliency.

Because secure snaps cannot be maliciously or accidentally deleted before any planned expiration date, they can be used to preserve multiple point-in-time copies from which data can be recovered if a malware or ransomware attack occurs. Snapshot policies can be automated to take secure snaps with a high frequency and a short retention duration for fine granularity, with a lower frequency and longer retention for added security, or a mixture of both. If an attack occurs, the user can review the secure snaps to determine which point in time has the most relevant and up-to-date copy of data without malware impact. When the precise point in time is identified, restoring critical data can be done almost instantaneously by bringing application data back to the original state before any attack.

Secure snaps also provide an additional layer of security in the case of multiple attacks and can be used for forensic work to help determine what happened during the attack and when it originally occurred. With the lower frequency and longer retention period, secure snaps can be used to validate data and data change rate to help identify any suspicious activity.

Traditional snapshots can be set with a scheduling frequency rate and retention policy that works best for the organization. These snapshots can be used for daily business continuity, such as development, operations, and data analytics. They can also assist in any forensic analysis and can be compared against secure snaps to help determine what changed and when the change began. Unlike secure snaps, traditional snapshots can be deleted or fail in array resource constraint situations. However, the data on an existing snapshot cannot be changed and could be used for additional recovery options.

Both secure and traditional snaps are a powerful tool that can be used to help protect and restore data rapidly, to minimize any impact of a malware or ransomware attack. The large scalability of snapshots can be easily managed using snapshot policies for scheduling frequency and retention time duration to fit any size organization.

The following list is an operational example of the frequency, retention, and scale out of the value of SnapVX secure snaps. The numbers are based on an average of 5,000 production volumes in a PowerMax array.

• Secure snaps every 10 minutes with a 48-hour retention

• 288 per volume point-in-time copies
• Fine-grain protection and recovery

• Secure snaps every 60 minutes with a 7-day retention

• 168 per volume point-in-time copies
• Extended protection and data validation

Total = 2,040,000 secure point-in-time copies

Figure 27.    Frequency, retention, and scale out of secure snaps

Ransomware attacks typically involve unauthorized data encryption. Dell AIOps Ransomware incidents algorithm analyzes data encryption patterns, compares them to baseline behavior, and raises an incident whenever an anomaly is detected. This guide helps identify, investigate, and respond to ransomware incidents using data metrics, logs, and additional indicators.

• Historical Seasonality: Defines value boundaries of normal behavior by analyzing a three-week historical pattern, useful for identifying anomalies in block storage. 
• Reducible Data: Volume of data on a Storage Group that can potentially be reduced. 
• Reducible Data Anomaly: When reducible data falls below historical boundaries, it may indicate potential encryption activity.

Use the following steps to investigate the incident:

1. Review Detection Details 

• Confidence Level: Prioritize investigations based on confidence level (High > Medium > Low), which reflects the likelihood of malicious encryption. 
• Storage Groups Affected: Review the number of Storage Groups showing anomalies. 
• Timestamp Review: Check Created and Updated times to monitor incident progression. 

2. Assess Incident Significance 

• Significance Level: Focus on high-significance incidents first, indicating a strong deviation from normal data behavior. 
• Log Analysis: The Logs column tracks anomaly frequency. Higher log counts may signal ongoing encryption. 

3. Analyze Reducible Data and Seasonality 

• Compare reducible data metrics to historical seasonality to detect significant deviations. 
• Anomaly Logs: Identify the specific date and time anomalies began to trace any corresponding system behavior. 

Figure 28.    Reducible data metrics and historical seasonality
 

4. Check Origin of Anomaly

• Identify the host or service likely responsible for the change (for example a single host showing increased write throughput across multiple LUNs).
• Consider multi-host involvement, which may indicate broader compromise.

False positives may be triggered by:

• Software Upgrades: Storage server or firmware updates may cause temporary deviations. 
• Configuration Changes: Adjustments in encryption, compression, or data reduction settings can mimic ransomware patterns. 
• Application Reassignment: Reassigning storage groups to different applications or factory resetting applications can disrupt expected usage patterns. 
• Time-Limited Events: Usage surges (for example, holiday e-commerce) may appear anomalous but are expected during specific periods.

Steps for validation:

1. Cross-Check with Other Tools: Look for corroborating signs from cybersecurity tools, such as user-reported issues or access anomalies. An absence of additional indicators doesn’t rule out true incidents but could guide response urgency. 

2. Analyze Network Traffic: Look for abnormal patterns like unexpected connections or unusual data transfer volumes, which may indicate communication with command-and-control servers. 
3. Search for Known Ransomware Signatures: Use anti-malware tools to detect any recognized ransomware patterns. 
4. Look for Ransom Notes: Many ransomware strains leave ransom notes in affected directories. Scan for newly added files with ransom instructions. 
5. Monitor System Performance: Sudden spikes in CPU, memory, or disk usage could indicate active encryption processes.

If ransomware is confirmed:

1. Create a Snapshot: Generate a snapshot to capture unencrypted data for potential recovery. Use immutability options like secure snaps to safeguard against ransomware affecting snapshots. 

2. Isolate Affected Systems: Disconnect affected storage groups to prevent spread but ensure this is based on a confirmed threat to avoid database or application consistency issues. 
3. Engage Security Experts: Bring in specialists for containment, eradication, and recovery support: Dell Incident Response and Recovery. 
4. Clean and Restore: Use anti-malware solutions to remove ransomware, then restore clean data from backups. 
5. Strengthen Security: Review and improve security policies and procedures post-incident to reinforce defenses.

Minimize false alerts by:

• Sensitivity Tuning: Configure detection sensitivity per Storage Group. Use a lower sensitivity default to avoid excessive false positives in low-risk groups. 
• Snapshot Policy: Implement a temporary (24-48 hour) snapshot upon detection to secure data until verification. 
• Proactive Isolation: In critical cases, consider isolating storage from compute if a confirmed threat exists, but coordinate closely with application teams.

Additional resources:

• Data-Driven Risk Assessment: Security validation and thorough documentation enable risk assessments aligned with business continuity requirements. 
• Dell Security Resources: Dell offers best practice guides and product-specific hardening resources for comprehensive cybersecurity support. For more information, visit Dell Security and Resiliency.

Ransomware attacks typically involve unauthorized data encryption. Dell AIOps Ransomware incidents algorithm analyzes data encryption patterns, compares them to baseline behavior, and raises an incident whenever an anomaly is detected. This guide helps identify, investigate, and respond to ransomware incidents using data metrics, logs, and additional indicators.

• Historical Seasonality: Defines value boundaries of normal behavior by analyzing a three-week historical pattern, useful for identifying anomalies in block storage. 
• Reducible Data: Volume of data on a Storage Group that can potentially be reduced. 
• Reducible Data Anomaly: When reducible data falls below historical boundaries, it may indicate potential encryption activity.

Use the following steps to investigate the incident:

1. Review Detection Details 

• Confidence Level: Prioritize investigations based on confidence level (High > Medium > Low), which reflects the likelihood of malicious encryption. 
• Storage Groups Affected: Review the number of Storage Groups showing anomalies. 
• Timestamp Review: Check Created and Updated times to monitor incident progression. 

2. Assess Incident Significance 

• Significance Level: Focus on high-significance incidents first, indicating a strong deviation from normal data behavior. 
• Log Analysis: The Logs column tracks anomaly frequency. Higher log counts may signal ongoing encryption. 

3. Analyze Reducible Data and Seasonality 

• Compare reducible data metrics to historical seasonality to detect significant deviations. 
• Anomaly Logs: Identify the specific date and time anomalies began to trace any corresponding system behavior. 

Figure 28.    Reducible data metrics and historical seasonality
 

4. Check Origin of Anomaly

• Identify the host or service likely responsible for the change (for example a single host showing increased write throughput across multiple LUNs).
• Consider multi-host involvement, which may indicate broader compromise.

False positives may be triggered by:

• Software Upgrades: Storage server or firmware updates may cause temporary deviations. 
• Configuration Changes: Adjustments in encryption, compression, or data reduction settings can mimic ransomware patterns. 
• Application Reassignment: Reassigning storage groups to different applications or factory resetting applications can disrupt expected usage patterns. 
• Time-Limited Events: Usage surges (for example, holiday e-commerce) may appear anomalous but are expected during specific periods.

Steps for validation:

1. Cross-Check with Other Tools: Look for corroborating signs from cybersecurity tools, such as user-reported issues or access anomalies. An absence of additional indicators doesn’t rule out true incidents but could guide response urgency. 

2. Analyze Network Traffic: Look for abnormal patterns like unexpected connections or unusual data transfer volumes, which may indicate communication with command-and-control servers. 
3. Search for Known Ransomware Signatures: Use anti-malware tools to detect any recognized ransomware patterns. 
4. Look for Ransom Notes: Many ransomware strains leave ransom notes in affected directories. Scan for newly added files with ransom instructions. 
5. Monitor System Performance: Sudden spikes in CPU, memory, or disk usage could indicate active encryption processes.

If ransomware is confirmed:

1. Create a Snapshot: Generate a snapshot to capture unencrypted data for potential recovery. Use immutability options like secure snaps to safeguard against ransomware affecting snapshots. 

2. Isolate Affected Systems: Disconnect affected storage groups to prevent spread but ensure this is based on a confirmed threat to avoid database or application consistency issues. 
3. Engage Security Experts: Bring in specialists for containment, eradication, and recovery support: Dell Incident Response and Recovery. 
4. Clean and Restore: Use anti-malware solutions to remove ransomware, then restore clean data from backups. 
5. Strengthen Security: Review and improve security policies and procedures post-incident to reinforce defenses.

Minimize false alerts by:

• Sensitivity Tuning: Configure detection sensitivity per Storage Group. Use a lower sensitivity default to avoid excessive false positives in low-risk groups. 
• Snapshot Policy: Implement a temporary (24-48 hour) snapshot upon detection to secure data until verification. 
• Proactive Isolation: In critical cases, consider isolating storage from compute if a confirmed threat exists, but coordinate closely with application teams.

Additional resources:

• Data-Driven Risk Assessment: Security validation and thorough documentation enable risk assessments aligned with business continuity requirements. 
• Dell Security Resources: Dell offers best practice guides and product-specific hardening resources for comprehensive cybersecurity support. For more information, visit Dell Security and Resiliency.

To enable OIDC SSO authentication in Unisphere for PowerMax, the following details are need:

• OIDC IdP (IP or Hostname)
• OIDC IdP Port
• OIDC Client ID
• OIDC Client Password
• OIDC Metadata URL
• Access Token Authentication Claim
• Access Token Authentication Value
• Alternative CA Certificates

A PowerMax administrator, or security administrator, who is enabling SSO, should contact the IdP administrator to obtain the above information. In turn, the IdP administrator must be provided with Unisphere callback URLs for all Unisphere instances where SSO is enabled, for example, https://unisphere IP/Hostname:port/univmax

Note: The /univmax is required.

PowerMax OIDC SSO authorization requires specific configuration for SSO users to access the array. The IdP administrator should provide the following information to anyone enabling SSO in Unisphere:

• The name of the OIDC identity token claim, which acts as the source of the username in the array, for example, sub, email, and username.
• Optionally, the name of the group claim (a JSON array in the token) and the name of the specific group member, if group-based authorization is required.

The username claim should be assigned to the USER SSO authorization rule. If group authorization is not required, the specific username rule should be narrowed, for example, FirstName.LastName@company.com.

Note: Authorization rules are case sensitive.

For authorization with groups, the USER SSO rule should be created with the minimal role, possibly NONE, without the username. A GROUP SSO authorization rule should be created for every OIDC identity token group specific to each group value-role assignment.

The following is a walkthrough of configuring SSO with an existing Entra instance.

View from the Entra ID overview page

• Take note of the Application (Client) ID.

Figure 29.    Entra ID overview page

Clink Endpoints

• Make note of the OpenID Connect metadata document endpoint.

Figure 30.    Endpoints

Create Client Secret

• Copy Secret Value to a safe place – will get hidden once navigated off page.

Note: SSO with Unisphere does not support Certificates.

Figure 31.    Certificate and secrets page

Within the Authentication page, add a redirect URL.

• IP or hostname of the Unisphere instance

Figure 32.    Authentication page

Create API permissions for access token.

Figure 33.    API Permissions

Add users to the Users and groups page.

Figure 34.    Users and groups page

Log in to Unisphere as an Admin

• Enabling SSO must be done by an Admin or Security Admin

View user roles by clicking the User Details

Figure 35.    User roles

To enable SSO, go to Settings > Users and Groups > Authentication.

• Input the relevant information from Entra ID instance

Figure 36.    Enabling SSO

Create an authorized user, go to Settings > Users and Groups > Authorized Users and Groups.

• User created with SSO authority using email (claim) to authenticate identity.

Figure 37.    Creating authorized user

Once SSO is enabled and user is created, log in to Unisphere.

• Leave User Name and Password blank
• Click Login

Click User Details to view logged in User Roles.

• User authenticated with Entra ID using the authorized user role

Figure 38.    User roles

To enable OIDC SSO authentication in Unisphere for PowerMax, the following details are need:

• OIDC IdP (IP or Hostname)
• OIDC IdP Port
• OIDC Client ID
• OIDC Client Password
• OIDC Metadata URL
• Access Token Authentication Claim
• Access Token Authentication Value
• Alternative CA Certificates

A PowerMax administrator, or security administrator, who is enabling SSO, should contact the IdP administrator to obtain the above information. In turn, the IdP administrator must be provided with Unisphere callback URLs for all Unisphere instances where SSO is enabled, for example, https://unisphere IP/Hostname:port/univmax

Note: The /univmax is required.

PowerMax OIDC SSO authorization requires specific configuration for SSO users to access the array. The IdP administrator should provide the following information to anyone enabling SSO in Unisphere:

• The name of the OIDC identity token claim, which acts as the source of the username in the array, for example, sub, email, and username.
• Optionally, the name of the group claim (a JSON array in the token) and the name of the specific group member, if group-based authorization is required.

The username claim should be assigned to the USER SSO authorization rule. If group authorization is not required, the specific username rule should be narrowed, for example, FirstName.LastName@company.com.

Note: Authorization rules are case sensitive.

For authorization with groups, the USER SSO rule should be created with the minimal role, possibly NONE, without the username. A GROUP SSO authorization rule should be created for every OIDC identity token group specific to each group value-role assignment.

The following is a walkthrough of configuring SSO with an existing Entra instance.

View from the Entra ID overview page

• Take note of the Application (Client) ID.

Figure 29.    Entra ID overview page

Clink Endpoints

• Make note of the OpenID Connect metadata document endpoint.

Figure 30.    Endpoints

Create Client Secret

• Copy Secret Value to a safe place – will get hidden once navigated off page.

Note: SSO with Unisphere does not support Certificates.

Figure 31.    Certificate and secrets page

Within the Authentication page, add a redirect URL.

• IP or hostname of the Unisphere instance

Figure 32.    Authentication page

Create API permissions for access token.

Figure 33.    API Permissions

Add users to the Users and groups page.

Figure 34.    Users and groups page

Log in to Unisphere as an Admin

• Enabling SSO must be done by an Admin or Security Admin

View user roles by clicking the User Details

Figure 35.    User roles

To enable SSO, go to Settings > Users and Groups > Authentication.

• Input the relevant information from Entra ID instance

Figure 36.    Enabling SSO

Create an authorized user, go to Settings > Users and Groups > Authorized Users and Groups.

• User created with SSO authority using email (claim) to authenticate identity.

Figure 37.    Creating authorized user

Once SSO is enabled and user is created, log in to Unisphere.

• Leave User Name and Password blank
• Click Login

Click User Details to view logged in User Roles.

• User authenticated with Entra ID using the authorized user role

Figure 38.    User roles

The following Dell Technologies documentation provides information related to this document. Access to these resources depends on your login credentials. If you do not have access to a document, contact your Dell Technologies representative.

• PowerMax and VMAX Info Hub
• A Detailed Overview of the Next Generation PowerMax Platform
• Dell PowerMax: Reliability, Availability, and Serviceability
• Dell CloudIQ: A Detailed Review
• Dell PowerMax Data at Rest Encryption
• Dell PowerMax and VMAX All Flash: Data at Rest Encryption
• Dell PowerMax and VMAX All Flash: TimeFinder SnapVX Local Replication
• Dell PowerMax 2500 and 8500: TimeFinder SnapVX Snapshots and Clones
• Dell PowerMax and VMAX All Flash: Snapshot Policies