1

Topic is SOC2 compliance relating to server hardware.

Simply put, we have a mixed bag of servers that, while perfectly suited to their job, are End of Life and End of Support with the manufacturer.

As an example, one of the servers is a Dell R710.

This server is an Hyper-V host. The VMs on the host run latest/greatest OS, including Windows 2019, CentOS 7/8, etc. Dell states that it is not supported for Windows 2016 and later.

The question is: if drivers are no longer being updated, but I can get Windows 2016/2019 installed, will this pass SOC2 (or PCI DSS)?

p.s. I have spent much keyboarding on Google, here, and elsewhere to try and understand this before posting - I assume I am just not using the right "key" phrase to find a solution.

2
  • 1
    The R710 was end of life four years ago so it definitely is vulnerable to the speculative execution flaws. There have also been several critical IPMI vulnerabilities in the iDRAC firmware/drivers over the past few years. I suspect if an auditor did a Qualys scan on this system it would be flagged. If you are not scanning your systems for vulnerabilities you should be. Example: nvd.nist.gov/vuln/detail/CVE-2020-5344
    – Greg Askew
    Jul 9, 2020 at 16:38
  • Thank you, Greg. I'm still learning to navigate all of this and this is what I expected. I am going through vendors for scanning as we speak. So far I'm going through trials of Nessus and Pulseway. Any recommendations? Edit: Just realized you mentioned Qualys. Any experience with it that it would be above other competitors? That's next on my list (familiar with it for PCI WAS).
    – Jay
    Jul 10, 2020 at 17:05

1 Answer 1

1

It depends. Where did the drivers you are actually using come from? Often, drivers for older hardware tend to get bundled into Windows itself, and get any necessary updates from Microsoft. If you got them from Dell and they are no longer updating them, then you might have a problem if a security issue is discovered in one of those drivers later. You may do as well or better with a Linux host, as all drivers bundled with Linux get security maintenance, and AFAIK all drivers this server needs are bundled with Linux.

The really important bit, though, is BIOS/firmware. There are STILL problems being found in the Spectre/Meltdown class of flaws, and still firmware/BIOS and microcode updates coming out for every new issue. If Dell has stopped providing BIOS/firmware updates for these issues, then you'll probably have to retire the hardware, as OS mitigations for these issues often depend on corresponding BIOS/firmware/microcode support all working in tandem (though be aware that the OS distributes microcode updates).

Ultimately, though, you are going to have to show all this to an auditor. For any given security issue you need to show that appropriate updates have been applied or an alternative mitigation has been used. This is easy enough, as all updates have accompanying documents showing what security issues they address, but it's paperwork. If the updates exist, you can do the paperwork. If they don't, you have nothing to show, and you'll probably fail the audit.

2
  • Thanks, Michael. Very good points and I suspected as much - I'm in that period where I know generally what to look for, but don't yet know all the questions to ask. This really helps. Any recommendations for a SOC2 noob?
    – Jay
    Jul 10, 2020 at 17:06
  • @Jay If you're doing updates regularly and all your documentation is good, then you should be fine. Jul 10, 2020 at 23:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.