This section covers hardening details for the different platform offerings of the solution. This includes the VxRail and PowerEdge platforms as well as security configuration details for the different VMware components.
Home > Edge > Retail Edge > Guides > Dell Validated Design for Retail Edge with Deep North - Design Guide > Platform security considerations
This section covers hardening details for the different platform offerings of the solution. This includes the VxRail and PowerEdge platforms as well as security configuration details for the different VMware components.
The PowerEdge team continuously evolves the security controls, features, and solutions to meet the ever-growing threat landscape. A key security foundation is Silicon Root of Trust. The White Paper: Cyber Resilient Security in Dell EMC PowerEdge Servers details the security features built into the PowerEdge Cyber Resilient Platform, many of which are enabled by the integrated Dell Remote Access Controller (iDRAC9). Many new security features have been added, which span from access control to data encryption to supply chain assurance. These features include:
Further details on iDRAC security can be found in the iDRAC9 Security Configuration Guide.
VxRail is a platform for IT infrastructure and security transformation. It provides layers of protection to keep your data and business applications secure. The Dell Technologies family of companies provide the full end-to-end solutions required to keep up with today’s evolving threat landscape. VxRail has security built in at every level of the integrated technology stack. This starts with each processor and PowerEdge server and continues through the VxRail HCI System Software, including the integrated VMware software, ensuring availability, integrity, and confidence for every workload, whether it be traditional or cloud native. For more information, see the Dell EMC VxRail: Security Technical Implementation Guide (STIG) on VxRail. It describes both integrated and optional security features, best practices, and proven techniques for securing your VxRail from the core to the edge to the cloud.
The VMware vSphere Security Configuration Guide 7 is the baseline for hardening and auditing guidance for vSphere itself. Started more than a decade ago, the SCG has served as a reference for vSphere administrators as they work to protect their infrastructure.
To further secure your data, encrypt data in transit in your vSAN cluster and encrypt data at rest in your vSAN datastore. vSAN can encrypt data in transit across hosts in the vSAN cluster. Data-in-transit encryption protects data as it moves around the vSAN cluster. vSAN can encrypt data at rest in the vSAN datastore. Data-at-rest encryption protects data on storage devices, in case a device is removed from the cluster. When you enable data-at-rest encryption, vSAN encrypts everything in the vSAN datastore. All files are encrypted, which protects all VMs and their corresponding data. Only administrators with encryption privileges can perform encryption and decryption tasks. For more information, see Using Encryption in a vSAN Cluster.
The following test cases provide detail on the vSphere validated security configuration settings. There are test cases for deployments with and without a vCenter-managed deployment. This is important to note, as some ESXi configurations are not applicable when managed by vCenter. The goal is to provide validated security settings that can be applied to the DVD deployment to provide simplified guidance.
Some configuration settings are highly recommended, such as integrating with a central logging server or applying different privileges to users based on job function. Other recommended settings, such as integrating with Active Directory (AD) or importing Certificate Authority (CA) signed certificates, depend on the environment of the organization and their security requirements.
Test description | Confirm vCenter can integrate with Microsoft Active Directory over an LDAPS connection. |
Configuration details |
|
Verification steps |
|
Helpful tips |
|
Test description | Test authorization controls relating specifically to vSphere users (for example, setting defined roles for network administrators or storage administrators). Includes creating users, or users imported from integrated LDAPS, with different privileges. This test adheres to the concept of least privilege within the organization. |
Configuration details | For this test, users have four levels: Administrator, Network and VM User (Custom Role), Read-Only rights, and No access rights(in verification).
|
Verification steps |
|
Helpful tips |
|
Test description | Confirm the vCenter capability to audit system events, such as successful or failed login attempts. |
Configuration details | Follow the procedure at the following link to view events in vSphere: View Events in vSphere Client. |
Verification steps |
|
Helpful tips | — |
Test description | Validate that vCenter can send logs to a central logging server or solution such as a SIEM. |
Configuration details | Follow instructions for UDP port 514 at the following link: Forward vCenter Server Log Files to Remote Syslog Server. |
Verification steps |
|
Helpful tips | The vCenter Server Management Interface (VAMI) can be accessed using <FQDN-vCenter>:5480. |
Test description | Validate the ability to replace the default vCenter instance certificate with one signed by a trust-third party of the organization's choice. |
Configuration details |
|
Verification steps |
|
Helpful tips |
|
Test description | Validate the ability of an ESXi host to integrate with an AD server for more effective management of users. |
Configuration details |
|
Verification steps |
|
Helpful tips |
|
Test description | Validating the ESXi vSphere web client can appropriately set permissions for local users on the platform. |
Configuration details |
|
Verification steps |
|
Helpful tips | This applies to local accounts on ESXi. It is recommended to leverage central authentication accounts as much as possible to reduce the overhead of managing multiple credentials across the network. |
Test description | Confirm that ESXi can log events such as authentication attempts. |
Configuration details |
|
Verification steps |
|
Helpful tips | — |
Test description | Validate that ESXi vSphere web client can send logs to a remote syslog logging server. |
Configuration details |
|
Verification steps |
|
Helpful tips |
|
Test description | Confirm that ESXi can manage firewall rules to manage incoming traffic. |
Configuration details |
|
Verification steps |
|
Helpful tips |
|
Test description | Confirm that vCenter can set firewall rules to manage incoming traffic. |
Configuration details |
|
Verification steps |
|
Helpful tips |
|
Test description | Confirm that services on ESXi can be disabled/enabled as needed to help reduce the attack surface. Note: This assumes SSH has been already enabled—it may be disabled by default. |
Configuration details |
|
Verification steps |
|
Helpful tips |
|
Test description | Confirm that certificates for ESXi can be issued by a trusted CA. |
Configuration details |
|
Verification steps |
|
Helpful tips | To import custom CA signed certificates into ESXi when managed by vCenter, follow this procedure: Certificate Mode Switch Workflows. This may cause disruptions and have certain requirements, such as temporarily disconnecting ESXi from vCenter. |