Hewlett Packard Enterprise (HPE) will be the first manufacturer to go back to the white box. The company announced a new campaign for the production of servers from components made in the United States. HPE will supply chain security for US customers through the HPE Trusted Supply Chain initiative. First of all, the service is intended for clients from the public sector, healthcare and financial services market participants.
HPE explains that, contrary to popular belief, security does not begin with the connection and operation of the equipment, it is laid down at the assembly stage. That is why it is so important to track the supply chain, labeling and all other processes. Components obtained in an unverified way may contain hardware and software backdoors (backdoors).
Through the HPE Trusted Supply Chain initiative, government companies and the public sector will be able to buy US-certified servers.
The first product to meet all security criteria will be the HPE ProLiant DL380T server. Not all of its components are made in the USA, but it is already possible to claim that the equipment belongs to the “Country of Origin USA” category, and not just American production, marked “Made-in-USA”.
Highlights of the new HPE ProLiant DL380T server:
- Enhanced security mode. The option is activated at the factory and allows you to increase the level of protection of the system against cyber attacks. The mode will require some authentication before entering the server.
- Protection against installing an unsafe OS. Uses UEFI Secure Boot to ensure it works exclusively with the factory-installed operating system.
- Locking server configurations. If you change the default settings, the system will notify you at boot. The option prevents any interference by third-party users.
- Intrusion detection. The function protects against physical interference. Server owners will receive a warning if someone tries to remove the server case or part of it. The option is active even when the server is turned off.
- Specialized secure delivery. HPE will provide a truck or driver if it is required to deliver the server directly from the factory to the customer's data center. This ensures that the equipment is not modified by intruders during the transportation of systems.
For security and flexibility of supply
Covid-19 pandemic a number of problems in the logistics of electronic components and systems. In addition, the operational and business processes of many enterprises responsible for the production and supply of electronics were disrupted. HPE decided to expand the number of supply channels to avoid dependence on one company or country. And diversity and flexibility in the supply chain is now a winning strategy for manufacturers around the world. Therefore, HPE manufactures the finished product in the same place where it intends to sell it - the United States.
In the state of Wisconsin, HPE has a site where personnel with a special permit works, it is here that it is planned to manufacture server equipment. Next year, they plan to develop a similar program for Europe by launching production in one of the EU countries.
HPE Trusted Supply Chain is not the first HPE initiative to strengthen information security. Previously, the Silicon Root of Trust project was launched. Its essence is in a secure long-term digital signature, which makes it possible to ensure security in the remote server management system (Integrated Lights Out). The server does not boot if firmware or drivers that do not match the digital signatures are found.
Most likely, HPE will be the first in a series of large companies returning to the "white assembly". Processes of transfer of capacities from China other companies moving assembly lines from China to Taiwan due to the trade war between the US and China.
Source: habr.com