PowerScale Security Baseline Checklist
As a security best practice, a quarterly security review is recommended. Forming an aggressive security posture for a PowerScale cluster is composed of different facets that may not be applicable to every organization. An organization’s industry, clients, business, and IT administrative requirements determine what is applicable. To ensure an aggressive security posture for a PowerScale cluster, use the checklist in the following table as a baseline for security.
This table serves as a security baseline and must be adapted to specific organizational requirements. See the Dell PowerScale OneFS: Security Considerations | Dell Technologies Info Hub white paper for a comprehensive explanation of the concepts in the table below.
Further, cluster security is not a single event. It is an ongoing process: Monitor this blog for updates. As new updates become available, this post will be updated. Consider implementing an organizational security review on a quarterly basis.
The items listed in the following checklist are not in order of importance or hierarchy but rather form an aggressive security posture as more features are implemented.
|
Security feature |
Configuration |
References and notes |
Complete (Y/N) |
Notes |
|
Data at Rest Encryption |
Implement external key manager with SEDs |
Overview | Dell PowerScale OneFS: Security Considerations | Dell Technologies Info Hub |
|
|
|
Data in flight encryption |
Encrypt protocol communication and data replication |
Dell PowerScale: Solution Design and Considerations for SMB Environments (delltechnologies.com)
PowerScale OneFS NFS Design Considerations and Best Practices | Dell Technologies Info Hub
Dell PowerScale SyncIQ: Architecture, Configuration, and Considerations | Dell Technologies Info Hub |
|
|
|
Role Based Access Control (RBAC) |
Assign the lowest possible access required for each role |
PowerScale OneFS Authentication, Identity Management, and Authorization | Dell Technologies Info Hub |
|
|
|
Multifactor authentication |
|
|
|
|
|
Cybersecurity |
PowerScale Cyber Protection Suite Reference Architecture | Dell Technologies Info Hub |
|
|
|
|
Monitoring |
Monitor cluster activity |
|
|
|
|
Cluster configuration backup and recovery |
Ensure quarterly cluster backups |
Backing Up and Restoring PowerScale Cluster Configurations in OneFS 9.7 | Dell Technologies Info Hub |
|
|
|
Secure Boot |
Configure PowerScale Secure Boot |
Overview | Dell PowerScale OneFS: Security Considerations | Dell Technologies Info Hub |
|
|
|
Auditing |
Configure auditing |
|
|
|
|
Custom applications |
Create a custom application for cluster monitoring |
GitHub - Isilon/isilon_sdk: Official repository for isilon_sdk |
|
|
|
SED and cluster Universal Key rekey |
Set a frequency to automatically rekey the Universal Key for SEDs and the cluster |
Cluster services rekey | Dell PowerScale OneFS: Security Considerations | Dell Technologies Info Hub |
|
|
|
Perform a quarterly security review |
Review all organizational security requirements and current implementation. Check this paper and checklist for updates: |
|
|
|
|
General cluster security best practices |
See the best practices section of the Security Configuration Guide for the relevant release, at PowerScale OneFS Info Hubs | Dell US |
|
|
|
|
Login, authentication, and privileges best practices |
|
|
||
|
SNMP security best practices |
|
|
||
|
SSH security best practices |
|
|
||
|
Data-access protocols best practices |
|
|
||
|
Web interface security best practices |
|
|
||
|
Anti-virus |
PowerScale: AntiVirus Solutions | Dell Technologies Info Hub |
|
|
|
Author: Aqib Kazi – Senior Principal Engineering Technologist