PowerScale Security Baseline Checklist
As a security best practice, a quarterly security review is recommended. Forming an aggressive security posture for a PowerScale cluster is composed of different facets that may not be applicable to every organization. An organization’s industry, clients, business, and IT administrative requirements determine what is applicable. To ensure an aggressive security posture for a PowerScale cluster, use the checklist in the following table as a baseline for security.
This table serves as a security baseline and must be adapted to specific organizational requirements. See the Dell PowerScale OneFS: Security Considerations white paper for a comprehensive explanation of the concepts in the table below.
Further, cluster security is not a single event. It is an ongoing process: Monitor this blog for updates. As new updates become available, this post will be updated. Consider implementing an organizational security review on a quarterly basis.
The items listed in the following checklist are not in order of importance or hierarchy but rather form an aggressive security posture as more features are implemented.
Table 1. PowerScale security baseline checklist
|
Security Feature |
Configuration |
Links |
Complete (Y/N) |
Notes |
|
Data at Rest Encryption |
Implement external key manager with SEDs |
PowerScale Data at Rest Encryption |
|
|
|
Data in flight encryption |
Encrypt protocol communication and data replication |
PowerScale: Solution Design and Considerations for SMB Environments PowerScale OneFS NFS Design Considerations and Best Practices PowerScale SyncIQ: Architecture, Configuration, and Considerations |
|
|
|
Role-based access control (RBACs) |
Assign the lowest possible access required for each role |
Dell PowerScale OneFS: Authentication, Identity Management, and Authorization |
|
|
|
Multi-factor authentication |
Dell PowerScale OneFS: Authentication, Identity Management, and Authorization Disabling the WebUI and other non-essential services |
|
|
|
|
Cybersecurity |
|
|
||
|
Monitoring |
Monitor cluster activity |
Dell CloudIQ - AIOps for Intelligent IT Infrastructure Insights |
|
|
|
Secure Boot |
Configure PowerScale Secure Boot |
See PowerScale Secure Boot section |
|
|
|
Auditing |
Configure auditing |
File System Auditing with Dell PowerScale and Dell Common Event Enabler |
|
|
|
Custom applications |
Create a custom application for cluster monitoring |
|
|
|
|
Perform a quarterly security review |
Review all organizational security requirements and current implementation. Check this paper and checklist for updates Monitor security advisories for PowerScale: https://www.dell.com/support/security/en-us |
|
|
|
|
General cluster security best practices
|
See the Security best practices section in the Security Configuration Guide for the relevant release at OneFS Info Hubs |
|
|
|
|
Login, authentication, and privileges best practices |
|
|
||
|
SNMP security best practices |
|
|
||
|
SSH security best practices |
|
|
||
|
Data-access protocols best practices |
|
|
||
|
Web interface security best practices |
|
|
||
|
Anti-Virus |
|
|
||
Author: Aqib Kazi