Hewlett Packard Enterprise (HPE) will become the first manufacturer to return to 'white box' assembly. The company announced a new campaign to produce servers from components made in the USA. HPE will ensure the security of the supply chain for American customers as part of the HPE Trusted Supply Chain initiative. The service is primarily intended for clients in the public sector, healthcare, and participants in the financial services market.
HPE explains that, contrary to popular belief, security does not start at the moment of connecting and operating the equipment; it is established at the assembly stage. Therefore, it is crucial to track the supply chain, labeling, and all other processes. Components obtained through unverified means may contain hardware and software backdoors.
With the HPE Trusted Supply Chain initiative, government organizations and the public sector will be able to purchase certified American servers.
The first product meeting all security criteria will be the HPE ProLiant DL380T server. Not all of its components are manufactured in the USA, but it can already be claimed that the equipment belongs to the 'Country of Origin USA' category, rather than just being marked as 'Made-in-USA'.
Distinctive features of the new HPE ProLiant DL380T server:
- Enhanced security mode. This option is activated at the factory and provides an increased level of protection against cyberattacks. The mode will require specific authentication before accessing the server.
- Protection against the installation of an insecure OS. UEFI Secure Boot is used to ensure operation only with the operating system pre-installed at the factory.
- Server configuration locking. If the default settings are changed, the system will notify upon booting. This option prevents any interference from unauthorized users.
- Intrusion detection. This feature protects against physical tampering. Server owners will receive a warning if someone attempts to open the server case or any part of it. The option is active even when the server is powered off.
- Specialized secure delivery. HPE will provide a truck or driver if it is necessary to deliver the server directly from the factory to the customer's data center. This ensures that the equipment is not tampered with during transportation.
For the security and flexibility of supplies
Covid-19 pandemic a number of problems in the logistics of electronic components and systems. Additionally, the operational and business processes of many companies responsible for the production and supply of electronics have been disrupted. HPE has decided to broaden the number of supply channels to avoid dependence on a single company or country. Diversity and flexibility in the supply chain are currently winning strategies for manufacturers worldwide. Therefore, HPE produces the finished product where it intends to sell it — in the USA.
In Wisconsin, HPE has a facility where personnel with special clearance operate; this is where server equipment is planned to be manufactured. Next year, a similar program is planned for Europe, launching production in one of the EU countries.
HPE Trusted Supply Chain is not HPE's first initiative aimed at enhancing information security. Previously, the Silicon Root of Trust project was launched. Its essence lies in secure long-term digital signatures, which provide security in the system of remote server management. (Integrated Lights-Out). The server does not boot if the firmware or drivers do not match the digital signatures.
HPE is likely to be the first in a series of major companies returning to 'white box' assembly. Processes are underway to relocate capacities from China other companies are moving assembly lines from China to Taiwan due to the trade war between the USA and China.
Source: habr.com
