HPE extends supply chain security by adding AMD EPYC™ processors

Increasing supply chain resiliency and server security

The HPE Trusted Supply Chain initiative responds to customers’ increasing concerns about supply chain security by assigning vetted U.S. HPE employees to the manufacturing process, lowering the risk for any unauthorized or rogue firmware or components to be inserted into our compute products.

And we even take it further than that by hardening our products, produced through the HPE Trusted Supply Chain, with a series of HPE-exclusive security features. These security features are an extension to our built-in and award-winning feature, the HPE-exclusive Silicon Root of Trust technology, which protects over 4 million lines of firmware from malware or ransomware and provides protection to millions of HPE computing products around the world.

Each of our security capabilities and processes further lock down the server and ensures the product is secure, not only during the supply chain process but also during run-time operations.

The HPE ProLiant DL385 Gen10 Plus v2 will ship with these five security features activated at the U.S. factory:

Placing servers in high-security mode. Our servers always ship to customers in production mode, but the HPE ProLiant DL385 Gen10 Plus v2 will also be placed into a high-security mode at the HPE factory in the U.S. This feature, invoked through iLO commands, reduces the attack surface for cyber attackers, making it more difficult to insert compromised code or malware into the server firmware. This mode locks down the host and requires specific authentication through encryption before any user can log into the server. Naturally, this makes it much more difficult for cyber criminals to gain access to our HPE ProLiant DL385 Gen10 Plus v2.

Enabling the UEFI Secure Boot feature. For customers who ask HPE to load their operating system at the factory, we enable the UEFI Secure Boot, which connects the HPE Silicon Root of Trust to the OS. An industry-recognized feature, affixing the UEFI firmware to the boot loader ensures the genuine and authenticated OS is initialized. If the customer chooses to load the OS on their own, this feature may be engaged once the HPE ProLiant DL385 Gen10 Plus v2 is delivered to the end-user location. Anti-virus software cannot detect hackers or an intrusion until the OS is fully running. Some astute bad actors try to compromise the OS before its anti-virus tools have a chance to start. The HPE UEFI Secure Boot ensures that doesn’t happen. 

Ensuring the HPE Server Configuration Lock. This takes cryptographic measurements, or images, of all the HPE ProLiant DL385 Gen10 Plus v2 firmware, hardware components, and options and creates a log inside the server. If any firmware, hardware, or options are altered, an immediate alert at boot-up is registered. Enabling this feature at the HPE factory essentially prevents all tampering or compromise to the server composition, no matter how slight. This feature uses a password, created by HPE, to lock down the server configuration at the factory. That password is then transmitted securely to the customer, who will unlock the server once it arrives. For customers who need to create some additional configuration to the server, perhaps through a reseller or partner, that password can unlock and then relock the server before it ships to the final destination. Thus, HPE is providing the ultimate security – along with flexibility for customers – simultaneously.  

Commissioning the HPE Chassis Intrusion Detection device. This mechanism protects the HPE ProLiant DL385 Gen10 Plus v2 from physical intrusion. Complementing and reinforcing the protection from the Server Configuration Lock, the Chassis Intrusion Detection Device registers an alert if the top of the server chassis is removed. Like an electronic deadbolt on your door, it logs an audit alert in the iLO firmware, even if the server does not have power. If any cyber attacker or unauthorized personnel ever open the server chassis, our customers will know someone has potentially been tampering with the server.

Authorizing specialized delivery services: These services include a dedicated truck and driver, if requested, to safely transport and deliver the HPE ProLiant DL385 Gen10 Plus v2 – right from the HPE factory to the end-user location. As an additional service, delivery options available to customers are the express service and the premier service. Through these options, customers may also request that HPE deliver, set up, and operationalize our HPE products in their data center. Once again, HPE offers high levels of security without sacrificing the flexibility customers need in their diverse and sometimes remote IT locations. 

Federal government, state and local agencies, healthcare, and financial services industries

Cybersecurity concerns generally transcend all market segments. No one wants to be the next government agency or company to have a breach as we’ve seen all too often in the past. We believe our new HPE Trusted Supply Chain initiative will be particularly for agencies or customers who are on the leading edge of cybersecurity protective requirements in federal, financial, and healthcare markets.

The HPE ProLiant DL385 Gen10 Plus v2 with the Trusted Supply Chain initiative option is perfect for our highest security-conscious customers. Many of those users are in the government sector and currently must comply with numerous regulations like the Defense Federal Acquisition Regulation Supplement (DFARS) and the Federal Acquisition Regulation (FAR), along with National Defense Authorization Act (NDAA). The financial services industry is also under numerous requirements for safeguarding the privacy of personal and monetary information of their clients. Finally, the healthcare industry has strict certification requirements, like HIPAA, requiring absolute patient information protection. 

The HPE Trusted Supply Chain initiative not only builds security from the ground up, it also enables HPE to manufacture and deliver products securely through our supply chain, directly to our customer locations.

As always, HPE is extending its leadership

HPE is, once again, out in front when it comes to protecting our customers. Watching the prevailing trends of supply chain issues, we’ve taken security of production and supply chain to a new level.

There is also always the concern about keeping products secure and importing from off-shore locations. HPE is taking a leadership position in addressing all these issues, with additional high-security features installed right at the factory. Of course, all the current HPE products undergo the strictest standards for cybersecurity protection throughout our supply chain process. As cyberattacks escalate in today’s uncertain environment, HPE is extending our product offering by adding the ProLiant DL385 Gen10 Plus v2 servers with AMD EPYC processors to our Trusted Supply Chain initiative.

Protecting and keeping our customers safe from cyber attackers has always been one of our highest priorities at HPE. For more information on our secure products, please check out:

• Hewlett Packard Enterprise becomes the only major server manufacturer to ship the world’s most secure industry-standard servers with U.S. Country of Origin
• HPE ProLiant Gen 10 Servers- Choose the Most Secure Server on the Planet
• AMD Infinity Guard features vary by EPYC™ Processor generations. Infinity Guard security features must be enabled by server OEMs and/or Cloud Service Providers to operate. Check with your OEM or provider to confirm support of these features. Learn more about Infinity Guard.
• Trust never sleeps: Why hardware roots of trust are essential for security
• HPE Compute Security