In the ever-evolving landscape of IT infrastructure, managing on-premises, multi-cloud, and hybrid cloud data centers presents significant challenges, including vendor lock-in and management at scale. To address these challenges, Dell Private Cloud supports scaled automation and management on the container or hypervisor of your choice, allowing for seamless re-deployment according to your business needs without licensing restrictions.

Each deployment option includes:

• Configuration of physical infrastructure (servers, storage, networking)
• Setup of cloud stacks or hypervisors
• Installation and readiness of applications

The Dell Private Cloud ensures that all system layers, from hardware to software, work cohesively, providing an automated and orchestrated experience that meets customer expectations.

A part of that cohesion is to provide the underlying cybersecurity functions and capabilities to counter the rising frequency and sophistication of cyber-attacks on today’s infrastructures.  Dell Private Cloud addresses these challenges by approaching security through the lens of two modern philosophies: Zero Trust and Defense in Depth. 

• Zero Trust can be summarized as "Never trust, always verify." While this is a catchy phrase, it doesn’t reflect the complexity of implementation.  Zero Trust requires continuous verification of every user and device before granting access to resources, regardless of their location or network permissions. 
• Defense in Depth involves implementing multiple layers of security controls to create a robust defense against potential attacks. This tiered approach ensures that even if one security measure fails, others are in place for a fallback to protect the system.

Separately both Zero Trust and Defense in Depth are solid approaches to security.  Combined, they provide Dell Private Cloud with a security strategy that minimizes the attack surface and provides multiple layers of security controls. This combination offers redundancies and built-in fallback security measures in case of compromise providing a secure, robust, and flexible infrastructure.

Note: For links to other documentation for this topic, see the Dell Technologies Support website for Dell Private Cloud.

Dell Technologies and the authors of this document welcome your feedback on this document. Contact the Dell Technologies team by email.

Author: Joann Kent

Let’s begin our discussion by considering the lifecycle of a product and how each step is secured.  Building in security starts long before the first line of code is written and continues all the way through until the final release.  Robust infrastructure enables security at every step of its lifecycle, and this holistic approach is fundamental to Dell's product development.

Delivering a comprehensive set of security features requires security to be prioritized at each stage of development. Dell achieves this focus via Dell’s Secure Development Lifecycle (SDL), which defines security controls that Dell product teams adopt while developing new features and functionality. Dell collaborates through many industry-standard venues such as SAFECode, Building Security In Maturity Model (BSIMM), and IEEE Center for Secure Design to ensure that industry practices are followed.

Figure 1.   Secure Development Cycle

Dell Private Cloud’s product development includes security that is integrated throughout the product lifecycle. Features are architected from a built-in security mindset, with our concepts and designs analyzed to assess the potential security impact. During development, we perform threat modeling, code reviews, and scanning of third-party components. Prior to release, we scan the software to validate that open vulnerabilities have been updated, malware is not present, and the data can be transmitted and received securely.

Dell has identified a baseline set of security capabilities to be implemented across its portfolio. These fundamentals enable Dell products to seamlessly integrate with customers' security infrastructures, meeting their security objectives and compliance requirements.  Dell executives, the Product and Application Security (PAS) Office, and other key stakeholders participate in this review process which includes many factors, such as the results of an internal security assessment of the product. The SDL is part of a broader set of processes within the secure design standard.

This benchmark for integrating security into Dell products is comprehensive and describes mandatory security functionality, which must be built into any Dell product. Following the SDL enables Dell products to meet customers’ rigorous security requirements, including:

• Aligning to regulatory requirements
• Minimizing the risks to Dell products and customer environments from security vulnerabilities.
• Identifying how to properly secure Dell engineering systems that contain source code to product-related intellectual property and ensuring the integrity of products deployed to customer environments.

Successful product security programs extend to outsourced components and software. Integrity tests within the supply chain are essential for building and preserving trust. Supply chain security is applying preventive and detective control measures that protect physical and digital assets, inventory, information, intellectual property, and people. Addressing information, personnel, and physical security reduces opportunities for the introduction of malware and counterfeit components into the supply chain.

Dell Technologies’ Supply Chain Risk Management program verifies the software components that are used in the company's products originate from properly vetted sources.  This program plays a critical role in combating the increase of attacks against supply chains with ransomware to extort organizations. Proactive verification, validation, and security testing activities throughout the lifecycle provides secure solutions and reduce the likelihood of malware or coding vulnerabilities being inserted into the software.

A robust cybersecurity program further strengthens software integrity by preventing unauthorized access to source code and minimizing the potential for malware to be introduced into a product before it is shipped to the customer. These measures are tightly aligned with Software Assurance Forum for Excellence in Code (SAFECode) guidelines and ISO 27034.

Finally, Dell Private Cloud development includes verifying that only the minimally required software components and microservices are packaged and run on the system.  This reduces the attack surface by limiting the opportunity for errant, compromised software to make its way into the supply chain and thus on the product.

One of the most critical preventative actions against cybersecurity threats an organization can take is to keep software updated. Updates and patches not only fix issues that might lead to downtime or improve performance; they often fix security vulnerabilities. Dell Private Cloud works closely with our partners to generate early notifications of security fixes which enables the Dell Private Cloud team to validate and prepare pre-qualified security patches quickly.

Dell Private Cloud continuously validates that all software components are at the latest versions and are still in use. When vulnerabilities are discovered, fixes are quickly developed to mitigate threats regardless of where they are. When a component or service is no longer in use, they are removed from the packaging.  Update bundles are extensively tested on the entire Dell Private Cloud software stack before being released to customers.  Administrators are notified through the Dell Private Cloud Extension software when updates are available and can also subscribe to Product and Security Advisories on the Dell Support Site. The administrator can download the update bundle directly and initiate or schedule an orchestrated update process. Updates are performed as rolling processes while the system remains online, serving the business. If a reboot is required, the VMs are automatically migrated to other nodes in the cluster before continuing.

Dell’s security support for our customers does not stop at delivery, because new vulnerabilities, particularly software related, are discovered regularly across the industry. For this reason, Dell established the Product Security Incident Response Team (PSIRT), responsible for coordinating the response and disclosure for all identified product vulnerabilities per Dell’s Vulnerability Response Policy. Dell strives to provide customers with timely information, guidance, and mitigation options to minimize risks associated with security vulnerabilities.

Typically, security updates are released to customers as new threats are encountered. Dell's Security Advisories and Notices are posted on the Security Advisories and Notices site.

Like the rest of our product security practices, Dell Vulnerability Response Practices are aligned to the Forum for Incident Response and Security Teams (FIRST), and international standards efforts involving vulnerability disclosure and handling, such as ISO 29147 and ISO 30111.

Dell Private Cloud builds on the foundational secure development and lifecycle layer by providing a wide range of security capabilities to protect both your data and infrastructure from a cyber-attack.

Dell Private Cloud software bundles are digitally signed, creating a virtual fingerprint that is unique to each package. Digital signatures provide a secure way to verify that the initial deployment and upgrade packages are authentic and valid. Dell Private Cloud Extension software is signed by running a secure hashing algorithm to calculate the bundle hash and then stores that value in a manifest file which itself is digitally signed.  These steps help maintain the integrity of the software package and provide assurance that the source of the bundle is Dell Technologies. The customer can follow a SolVe procedure to validate the digital signature and message digests in the manifest.

UEFI Secure Boot is a security feature designed to ensure that the product only boots using software that is trusted by the manufacturer, in this case Dell, protecting the operating system from corruption and rootkit attacks. UEFI Secure Boot validates that the Dell Private Cloud Extension software and boot loader are all digitally signed by a trusted authority and validated as genuine Dell software that has not been changed or substituted.

Secure Boot is supported by default with Dell Private Cloud deploying VMware.

Keeping customer data, especially sensitive information, confidential and out of malicious hands is fundamental to infrastructure security. Dell Private Cloud employs security controls to protect the confidentiality of data in use, data in motion, and data at rest.

FIPS 140-2 Level 1

As part of FIPS 140-2 Level 1 compliance, Dell Private Cloud utilizes OpenSSL FIPS crypto modules for encryption of all local data at rest and in transit.

Secure management with HTTPS

Unsecure management traffic is a significant security risk. Dell Private Cloud mitigates this risk by employing the use of TLS (Transport Layer Security) to encrypt all ingress and egress communications.  TLS ensures that all data-in-flight is secure over HTTPS protocol. Please reference support material for current TLS versions as they are subject to change.

At the core of Zero Trust’s “Never Trust, Always Verify” is Identity and Access Management (IAM). 

IAM focuses on verifying that any entity attempting to access any dimension or layer of a product is known, valid, allowed, and tracked.  Authentication is the act of challenging for proof of identity then checking that the provided credentials are valid and represent an identity known within the deployment.  Authorization confirms that the now validated entity is allowed to access the requested resource, and Auditing keeps tabs on that entity to discover if they are acting in an inconsistent or malicious way.

Authentication can be tricky in larger datacenters, where users might be challenged multiple times and struggle with remembering individual passwords, while administrators deal with the daunting task of managing users across disparate deployments which often don’t work well together.  Modern datacenters tackle these issues with Single Sign-On (SSO), which uses a centralized authority (i.e. Identity Provider) to simplify authentication and enhances security features such as Multi-Factor Authentication. 

Authentication to Dell Private Cloud is handled by the chosen platform’s SSO mechanism, mediating access for the Dell Private Cloud Extension and REST APIs.

Adhering to the Principle of Least Privilege, Dell Private Cloud includes a minimal set of management users out of the box.  There is a built-in initial user leveraged for deployment activities which is eliminated upon deployment’s completion.  While during deployment, the customer may choose to configure and maintain a management user in alignment with their own security guidelines for user and password naming. 

According to the Principal of Least Privilege, a user must be Authorized to access a requested resource. The most common form of Authorization is Role-Based Access Control (RBAC) which involves checking what roles are assigned to the entity and whether the corresponding permissions align with the access request. Once again, we rely on the platform to assign, manage, and validate authorizations.

Understanding changes in configuration and component status is vital to keeping systems secure and available.  It is important to determine if a setting change is due to a deliberate deviation or a malicious act.  By leveraging auditing capabilities, organizations can increase their security through proactive monitoring.

Timely detection when an intrusion happens can mean the difference between a brief interruption where the attacker is unable to access any critical systems, and an intrusion that persists for months leading to the compromise of multiple systems. Without properly maintained audit logs, it may be difficult to gather adequate information about the attack to determine its severity.

The challenge with monitoring the information is that it comes from many different sources such as, an individual VM, a physical server, the virtualization infrastructure, the network, security components, or the applications themselves. Making sense of this information requires a consolidated view of activity and changes. Each Dell Private Cloud allows for integration into SIEM tools for centralizing, real-time monitoring and advanced security analysis of auditing.  Dell Private Cloud also uses the industry standard Network Time Protocol (NTP) to keep all the component clocks synchronized for easier log correlations.

An important layer of Defense in Depth is infrastructure observability through telemetry.  By enabling real-time monitoring and detection, telemetry—including diagnostics, configurations, usage data, performance, deployment location information, and system information—provides continuous insights into system states, allowing for the swift identification and response to potential threats. This enhanced visibility uncovers blind spots and helps us understand system interactions. During incidents, telemetry offers detailed logs for investigation and prevention. It supports compliance by supplying audit data, ensuring regulatory adherence. Additionally, telemetry aids in proactively managing threats and optimizing security tools, identifying vulnerabilities and fine-tuning measures for greater efficiency. These capabilities highlight the critical role of telemetry in maintaining a secure and resilient infrastructure.

Dell Private Cloud offers built-in telemetry options via the Dell Automation Platform.  Each Dell Private Cloud Extension can connect through a “superpipe” to Dell Automation Platform orchestrator, via the Dell Automation Platform agent, which then links back to Dell Technologies. This setup facilitates remote IT support and monitoring through telemetry for enhanced issue resolution which can include remote product access, service request generation and other advanced capabilities.

For more information about these observability options, please refer to Dell Automation Platform documentation.

Figure 2.   Connecting to Dell Secure Remote Services via Dell Automation Platform orchestrator

Dell Private Cloud is committed to delivering a consistent set of functionalities and foundational security across all platforms. Additionally, whenever feasible, we leverage the security features provided by the underlying partner platform to enhance our security posture. 

With Dell Private Cloud running VMware, customers can take advantage of VMware by Broadcom’s advanced security capabilities according to their needs.  Please refer to Broadcom for VMware’s documentation for more details.

The Dell Private Cloud deploying Red Hat OpenShift installs and leverages the ServiceMesh feature to provide enhanced security protections.  The ServiceMesh provides mutual TLS to encrypt and protect communications between microservices.  It also offers the ability to automatically rotate mTLS certificates, configure service RBAC and authorization policies, and manage API traffic - which can be leveraged to define which services are allowed to communicate.

Please refer to Red Hat OpenShift documentation for more information on the ServiceMesh and other advanced security features offered.

Dell Private Cloud prioritizes security by aligning with the principles of Zero Trust and Defense in Depth to provide a secure security foundation.  With robust security lifecycle management, cryptographic protections, IAM, and observability, this foundation forms a comprehensive framework for infrastructure security. By embracing these strategies, organizations can build a resilient security posture that adapts to the dynamic threat landscape, ensuring the protection of critical assets and data.

Dell Technologies understands security and has experts worldwide who can help you assess your environment and design a security plan to meet your unique requirements. Contact your Dell Technologies representative for more information.

The following documentation provides additional and relevant information. Access to these documents depends on your login credentials. If you do not have access to a document, contact your Dell Technologies representative.

• Dell Security and Trust Center
• Dell Vulnerability Response Policy
• Secure Development at Dell
• Secure Connect Gateway
• Dell Technologies Support for Dell Private Cloud documentation

The following documentation provides additional and relevant information:

• NIST Cyber Security Framework