Supply chain security is an immense and dynamic threat
that’s top of mind for enterprise customers.
Hewlett Packard Enterprise has developed ways to secure solutions
from factory to data center,
committing to security from production until it’s safely in your hands.
In this demo we walk through ‘Server Configuration Lock’,
an innovative security solution
that protects the server configuration against tampering,
and the ability to detect and address possible security vulnerabilities.
First, we’ll need to access the system utilities screen
by clicking or pressing ‘F9’ as the server boots up.
Once in system utilities, select the ‘System Configuration’ option.
Now, select ‘BIOS/Platform Configuration (RBSU).’
In the BIOS/Platform Configuration (RBSU) settings,
select the Server Security option.
On the server security screen, select the “server configuration lock” option.
Then select Setup Server Configuration Lock.
On this screen, we have the flexibility to exclude
certain items from being part of the server configuration lock, such as
DIMM’s, CPU’s, PCIe slots, security configuration and firmware revisions.
These settings can be tailored to fit specific environments needs
as the server moves through a configuration lifecycle.
For example, if we frequently add Dimms or update firmware,
we may want to exclude these from triggering a server configuration lock
mismatch, allowing work to be done seamlessly.
Let’s generate a digital fingerprint for the server configuration lock.
Once selected,
create a password to enable the server configuration lock fingerprint.
Reenter the password to confirm the passwords match.
After confirming the password,
we will return to the Server Configuration Lock Options screen.
Keeping the default Server Configuration lock settings,
select the F12 Save and Exit.
With the server configuration lock enabled
we are now required to do a reboot for the new settings to take effect.
When we decide to reboot,
it doesn’t matter how long the server was left unattended
or where it was left unattended such as in transport,
the server is protected with Server Configuration Lock.
If we receive a Server Configuration Lock Digital Fingerprint
mismatch notification, such as this one,
we are being notified that someone has tampered with our components,
configuration, firmware or other security settings.
This security feature is advanced,
hackers don’t realize they are triggering any alarms
when making unauthorized modifications.
They believe they are going undetected.
In order to complete booting and gain access to the system,
we must input the Server Configuration Lock password.
If we select enter (yes), like in this example,
the fingerprint lock will be regenerated,
but Server Configuration Lock will remain enabled.
Let’s navigate back into our server configuration lock settings screen
to review the log and more details on the security breach. Select RBSU.
Select Server Security.
Now select Server Configuration Lock Options.
From here we have the option to view the server Configuration lock detection log
for more details or clear the log once we are aware
of what triggered the fingerprint mismatch.
Further security features can be enabled
to provide the maximum security coverage and flexibility needed.
The first is the Server Configuration lock password Challenge,
which requires password entry on every reboot.
Second is ‘Prepare for Transport.’
This feature is turned on before the server moves,
allowing for the receiving party to ensure the security of the server
before it arrives to its destination.
Once it arrives the preconfigured password will need to be input.
The most preemptive security feature is
Halt on server configuration lock failure detection.
If the server is tampered with,
the system will not boot until it is fixed using a rest command
to disable the feature.
Enabling HPE Server configuration lock advanced options gives you the flexibility
to customize the level of security your company needs,
protecting your servers from unauthorized configuration changes,
and securing your peace of mind,
whether your server is in transit, at the edge or in the data center.