[ Applies to ] StorageGuard / IBM DS8000 / Block & SAN Storage
This article lists the recommended baseline checks for IBM DS8000. Core6 updates the list periodically as new StorageGuard checks become available.
In this article
Overview
IBM DS8000 series systems are enterprise block storage platforms designed for the highest levels of availability and performance, commonly used with IBM Z and mission-critical open-systems workloads.
Why hardening IBM DS8000 matters
DS8000 systems often host core transactional databases and shared services. Role-based access, encryption at rest and in transit, secure remote support and comprehensive auditing protect this data, because a security or availability incident can directly affect business operations.
Recommended baseline checks
The baseline below contains 53 checks, listed alphabetically.
| ID | Configuration check | Component |
|---|---|---|
| SG-C0393T248V01 | Account lockout threshold | DS Storage Manager |
| SG-C0307T248V01 | Admin account status | DS Storage Manager |
| SG-C0163T225V01 | Approved AD domain | DS8000 |
| SG-C0044T248V01 | Approved KMS server | DS Storage Manager |
| SG-C0015T248V01 | Approved Syslog servers | DS Storage Manager |
| SG-C0029T248V01 | Centralized log server | DS Storage Manager |
| SG-C0233T248V01 | Centralized log server redundancy | DS Storage Manager |
| SG-C0235T225V01 | Certificate key size | DS8000 |
| SG-C0065T225V01 | Data at-rest encryption | DS8000 |
| SG-C0080T225V01 | Data in-transit encryption | DS8000 |
| SG-C0137T225V01 | Disable inactive users | DS8000 |
| SG-C0566T248V01 | Dual control for recovery key management | DS Storage Manager |
| SG-C0849T225V01 | Encrypted Extent Pools use valid key group | DS8000 |
| SG-C0846T225V01 | Encryption key group accessible | DS8000 |
| SG-C0845T225V01 | Encryption key group status | DS8000 |
| SG-C0074T225V01 | Encryption key rotation status | DS8000 |
| SG-C0175T248V01 | Event types enabled for audit logging | DS Storage Manager |
| SG-C0510T248V01 | External key manager status | DS Storage Manager |
| SG-C0183T225V01 | FC security policies | DS8000 |
| SG-C0848T248V01 | Key Manager Connectivity Healthy | DS Storage Manager |
| SG-C0049T248V01 | KMS server configuration | DS Storage Manager |
| SG-C0052T248V01 | KMS server redundancy | DS Storage Manager |
| SG-C0844T248V01 | KMS server status | DS Storage Manager |
| SG-C0039T248V01 | LDAP server configuration | DS Storage Manager |
| SG-C0025T248V01 | LDAP server redundancy | DS Storage Manager |
| SG-C0040T248V01 | LDAP service status | DS Storage Manager |
| SG-C0843T248V01 | Legacy management ports and services | DS Storage Manager |
| SG-C0394T248V01 | Mail (SMTP) settings | DS Storage Manager |
| SG-C0234T248V01 | Maximum password age | DS Storage Manager |
| SG-C0262T248V01 | Minimum password age | DS Storage Manager |
| SG-C0264T248V01 | Minimum password length | DS Storage Manager |
| SG-C0239T248V01 | Multi-factor authentication | DS Storage Manager |
| SG-C0230T248V01 | Non-default local admin | DS Storage Manager |
| SG-C0231T225V01 | Non-default local users | DS8000 |
| SG-C0284T248V01 | Password history | DS Storage Manager |
| SG-C0248T225V01 | Port security feature status | DS8000 |
| SG-C0293T225V01 | Protected recovery copies | DS8000 |
| SG-C0847T225V01 | Recovery key state | DS8000 |
| SG-C0051T248V01 | Required KMS server | DS Storage Manager |
| SG-C0016T248V01 | Required Syslog servers | DS Storage Manager |
| SG-C0167T248V01 | Security officer account | DS Storage Manager |
| SG-C0565T225V01 | SED encryption status | DS8000 |
| SG-C0447T225V01 | Self-signed certificate | DS8000 |
| SG-C0146T248V01 | SMTP enabled | DS Storage Manager |
| SG-C0395T248V01 | SMTP server configuration | DS Storage Manager |
| SG-C0155T248V01 | SNMP service disabled | DS Storage Manager |
| SG-C0365T225V01 | SSL authentication status | DS8000 |
| SG-C0019T248V01 | Target OS version - Code Bundle | DS Storage Manager |
| SG-C0019T248V02 | Target OS version - LMC | DS Storage Manager |
| SG-C0005T248V01 | TLS audit logging | DS Storage Manager |
| SG-C0390T248V01 | TLS level | DS Storage Manager |
| SG-C0448T225V01 | Trusted certificate-authority (CA) | DS8000 |
| SG-C0213T248V01 | Use of secure LDAP | DS Storage Manager |
Related components
A complete baseline also covers the components that manage, connect to or protect IBM DS8000. Review the configuration of:
- DS8000 Storage Manager (DS GUI) and DS CLI hosts
- Hardware Management Console (HMC)
- IBM Copy Services Manager
- External key managers
Run checks with StorageGuard
[ Still need help? ]
Our support team is here to help. Submit a request.
Comments
0 comments
Please sign in to leave a comment.