White Papers

Copyright © 2019 Dell Inc. or its subsidiaries. All Rights Reserved. Dell, EMC and other trademarks are trademarks of Dell Inc. or its subsidiaries
Layer 2: PowerEdge Systems Security
All Dell EMC PowerEdge servers offer built-in security that supports customers with compliance, preventive
security, and fast means to recover in the event of errors or breaches. This includes FIPs/Common Criteria
Compliance, immutable silicon root of trust (PowerEdge CPUs have a Dell signature: once it is used in a Dell
system if cannot be used in another server), digitally signed firmware updates, automatic BIOS recovery,
firmware rollback, and more.
In addition, Dell EMC offers differentiated security features in every PowerEdge system:
• Dell EMC OpenManage Secure Enterprise Key Manager –embedded in Dell EMC PowerEdge
servers and works in conjunction with leading Key Management Servers for enabling keys at scale
• System Lockdown – Locks down the configuration and firmware, protecting the server(s) from
inadvertent or malicious changes, and is enabled or disabled by the IT Administrator… and
prevents system/firmware “drift”
• System erase of all user drives, including NVMe – through a process that is not only fast, but
enables the drives to be reused and meets NIST recommendations for data erasure
• Rapid OS Recovery – Allows users to boot a trusted backup OS image from a hidden boot device
• Enhanced UEFI secure boot with custom certificates – with UEFI Secure Boot, each component
in the chain is validated and authorized against a specific certificate before it is allowed to load or
run
• Dynamically-enabled USB ports
o This feature allows administrators to disable all USB ports and then enable them dynamically to
allow local crash cart usage (to let a local technician have temporary access)
o The USB ports can be dynamically enabled and disabled without rebooting the server; normally
changing the USB port state requires a reboot and takes down the workloads
• Intrusion-switch included – detection of chassis intrusion at no extra expense
• Domain Isolation - an important feature for multi-tenant hosting environments, hosting providers
may want to block any re-configuration by tenants. Domain isolation is a configuration option that
ensures that management applications in the host OS have no access to the out-of-band iDRAC or
to Intel chipset functions
For more information, see this technical brief:
Security in Server Design
And this video for further information:
Server Security – Dell EMC PowerEdge Servers
Layer 3: Dell Technologies Factory Security
Factories where Dell products are built must meet specified Transported Asset Protection Association
(TAPA) facility security requirements, including the use of closed-circuit cameras in key areas, access
controls, and continuously guarded entries and exits. Additional controls are applied at Dell and supplier-
managed facilities and for air, rail, and ocean shipments to address the variety of risks faced across
transportation modes and regions. Some of these protections include tamper-evident packaging, security
reviews of shipping lanes, locks or hardware meeting required specifications, and container integrity
requirements. GPS tracking devices may also be placed on any container and monitored 24x7 until
confirmation of delivery.