HPE Workload Aware Security: технические характеристики и документация

HPE Workload Aware Security for Linux

HPE Workload Aware Security for Linux (WASL) is a one-click security compliance tool designed to secure Operating System and Applications. It is based on open architecture supplemented by years of security expertise and HPE Intellectual Property.

HPE Workload Aware Security for Linux (WASL) supports

• ~90% out-of-box compliance to Linux and SAP HANA security standards
• Compliance can be achieved in minutes not days
• Comprehensive actionable audit reports

HPE Workload Aware Security for Linux (WASL) assures security compliance for SAP HANA workloads and/or the underlying Linux operating system (OS) instance. Security compliance can be established before deploying the system into production and use WASL to ensure continued compliance while in production. The operating system is checked for security compliance to the security benchmark for Linux from the Center for Internet Security (CIS). SAP HANA configurations are secured to the published SAP HANA security guide specification. 

HPE WASL provides single click security:

• Evaluating the Linux OS compliance
• Evaluating the SAP HANA compliance
• Optionally remediate Linux OS to industry standards
• Optionally remediate SAP HANA to SAP security standards 

A license purchase includes 1 year of 24x7 Technical Support and Software Updates Service. Software updates are distributed by HPE Pointnext Services to customers with support contracts.

What's new with HPE WASL 1.3.1

• Easily migrate from WASL 1.2. to 1.3.1 

- Including WASL SMS data and settings

• Simple Policy Update & Alert Support

- Patch or update deployed policies on SAP HANA and Linux workloads

• WASL supported as a virtual appliance

- The Security Management Station (SMS) can be deployed as a virtual appliance on VMWare ESXi

• Convert WASL 30-day trial version to production version

Benefits

Purpose built for SAP HANA

Easy deployment

Shorten time to production

• First solution covering both Linux OS (SLES/RHEL) and SAP HANA application
• Comprehensive audit reports
• No separate training required for System Administrators

• Push-button security with default profiles for OS's (SLES/RHEL) and SAP HANA workloads
• Customizable templates
• Integrate existing hardening scripts and processes

• Security compliance in minutes instead of days
• Instant rollback
• ~90% out-of-box compliance

Superior RoI

State of Art

• Single click evaluation and remediation
• Maintaining compliance reduces chances of sanctions and fines
• Automate guidelines, checklists and specialized knowledge

• Automatic security compliance - assessment and remediation, easily run at regular intervals to check and keep compliance current, provides a rollback option to reinstate previous state.

License Models

How to order HPE Workload Aware Security for Linux

The following products can be ordered through an HPE Sales Representative or HPE Distributor.

HPE workload Aware Security for Linux is available in two different offerings:

• HPE Workload Aware Security for Linux BASIC license is a low cost offering for customers who want to assure security compliance for a Linux Operating system instance. One WASL Basic license secures a single OS instance.

HPE Workload Aware Security for Linux BASIC

HPE Workload Aware Security for Linux x86 Basic 1yr Support Instance E-LTU

Q8K91AAE

HPE Workload Aware Security for Linux x86 Basic 1yr Support Instance LTU

Q8K91A

HPE Workload Aware Security for Linux x86 Basic Media

Q8K93A

• HPE Workload Aware Security for Linux ADVANCED license is for SAP HANA appliance and TDI customers, requiring SAP HANA security compliance. One WASL Advanced license will secure 1 SAP HANA instance aka single system ID (SID) as well as its associated OS instance.

NOTE: For SAP HANA scale-out implementation an Advance license is required for the master node and Basic license for each of the other nodes.

HPE Workload Aware Security for Linux Advanced

HPE Workload Aware Security for Linux x86 Advanced 1yr Support Instance E-LTU

Q8K92AAE

HPE Workload Aware Security for Linux x86 Advanced Instance LTU

Q8K92A

HPE Workload Aware Security for Linux x86 Advanced Media

Q8K94A

WASL Components

WASL software is composed of the Security Management Station (SMS) and Node Packages. SMS is a graphical user interface to centrally register, track compliance and manage all the instances of servers and applications (called Workloads) in the environment. The SMS also provides many options for assigning roles to meet a wide variety of security policies and procedures. 

The Node Packages runs on the end Workload instance, performing operations such as evaluation and remediation, it is controlled by the SMS. The Node Packages is installed on the target Workload instance either during the Workload registration or manually by the administrator directly on the Workload node.

The software can be ordered with a new system purchases or ordered separately for existing server running Red Hat Enterprise Linux or SUSE Enterprise Linux. Physical and electronic delivery methods are offered. Physical delivery requires the software media to be ordered separately. Electronic delivery includes a software download.

A license purchase includes 1 year of 24x7 Technical Support and Software Updates Service. Customer needs to have a valid support contract to get the latest updates on WASL and its default set of policies.

Implementation Services are available separately.

HPE Workload Aware Security for Linux Configurations

NOTE: This is a list of supported configurations at time of writing. Please refer to the HPE Workload Aware Security for Linux Support Matrix for the most up-to-date list of supported configurations and important notes and caveats.

SMS Virtual Appliance Support and Requirements

VMware ESXI

VMware ESXi 6.0

VMware ESXi 6.5

VMware ESXi 6.7

Memory Requirements

HPE WASL SMS requires minimum 16GB  of lockable memory

Disk Requirement

HPE WASL SMS requires minimum 30GB of disk space

vCPU Requirement

Minimum 4 cores recommended for HPE WASL SMS

Target Software Workload Support

Linux Distributions

• Red Hat Enterprise Linux 7

- RHEL7.2, 7.3, 7.4, 7.5, 7.6

• SUSE Linux Enterprise Server 12

- SLES 12 SP1, SP2, SP3, SP4

• SUSE Linux Enterprise Server for SAP Applications 12

- SLES 12 SP1, SP2, SP3, SP4

• SUSE Linux Enterprise Server 15
• SUSE Linux Enterprise Server for SAP Applications 15

NOTE: The SLES 15 OS policies will be updated when the associated CIS benchmark is published.

SAP HANA Databases

• SAP HANA 1.0 SPS12
• SAP HANA 2.0 SPS02, SPS03, SPS04

Hypervisors

• VMware ESX and ESXi, Linux KVM
• Others supporting RHEL 7 and SUSE 12

Hardware Support

HPE Servers & Appliances

• Any HPE x86_64 servers
• Certified TDI servers for SAP HANA

Implementation Service Information

HPE offers an installation and start up service that will address Linux customer needs to create a basic HPE Workload aware Security for Linux configuration.

Please contact Pointnext for WASL installation service.

Support Information

Protect your business beyond warranty with HPE Support Services

HPE support services offer complete care and support expertise with committed response choices that are designed to meet your IT and business needs. With each support offer, customers can customize their reactive support level by selecting either 6-hour call-to-repair, 24x7 with 4-hour onsite response, or next business day onsite response.

NOTE: HPE SAP HANA Appliance/TDI support contract do not cover WASL, a separate support contract for WASL is required. 

WASL support options  specifically for the WASL software includes

• HPE Foundation Care Service offers scalable reactive support-packages. You choose the type and level of service that is most suitable for your IT and business needs.
• HPE Proactive Care Service helps in problem prevention, with predictive analytics, personalized analysis with recommendations and advice paired with rapid access to technical experts to help rapidly resolve any problem. You receive an enhanced call experience and a single point of contact for the support. 
• HPE Proactive Care Advanced Service builds on HPE Proactive Care, providing additional benefits such as the assignment of a dedicated, local account support manager (ASM) for collaboration and best practices and critical event management that provides 24x7 fast response and IT service restoration with incident follow-up to prevent a repeat. All of this is designed to give you an incredibly personalized, high-touch support experience that keeps your system fully available and running at peak performance.
• HPE Datacenter Care for large, complex environments where a more personalized, customized approach to support is needed. This is a contractual sale and provides one contract for all a customer's reactive and proactive needs.

Warranty

Hewlett Packard Enterprise will replace defective delivery media for a period of 90 days from the date of purchase.

Services when ordering through an approved HPE channel partner use the following:

HPE 3 Year Foundation Care 24x7 Workload Aware Security for Linux Basic LTU Service

U5JY6E

HPE 4 Year Foundation Care 24x7 Workload Aware Security for Linux Basic LTU Service

U5JY7E

HPE 5 Year Foundation Care 24x7 Workload Aware Security for Linux Basic LTU Service

U5JY8E

HPE 3 Year Proactive Care 24x7 Workload Aware Security for Linux Basic LTU Service

U5JY9E

HPE 4 Year Proactive Care 24x7 Workload Aware Security for Linux Basic LTU Service

U5JZ0E

HPE 5 Year Proactive Care 24x7 Workload Aware Security for Linux Basic LTU Service

U5JZ1E

HPE 3 Year Proactive Care Advanced 24x7 Workload Aware Security for Linux Basic LTU Service

U5JZ2E

HPE 4 Year Proactive Care Advanced 24x7 Workload Aware Security for Linux Basic LTU Service

U5JZ3E

HPE 5 Year Proactive Care Advanced 24x7 Workload Aware Security for Linux Basic LTU Service

U5JZ4E

HPE 3 Year Foundation Care 24x7 Workload Aware Security for Linux Advanced LTU Service

U5JZ5E

HPE 4 Year Foundation Care 24x7 Workload Aware Security for Linux Advanced LTU Service

U5JZ6E

HPE 5 Year Foundation Care 24x7 Workload Aware Security for Linux Advanced LTU Service

U5JZ7E

HPE 3 Year Proactive Care 24x7 Workload Aware Security for Linux Advanced LTU Service

U5JZ8E

HPE 4 Year Proactive Care 24x7 Workload Aware Security for Linux Advanced LTU Service

U5JZ9E

HPE 5 Year Proactive Care 24x7 Workload Aware Security for Linux Advanced LTU Service

U5KA0E

HPE 3 Year Proactive Care Advanced 24x7 Workload Aware Security for Linux Advanced LTU Service

U5KA1E

HPE 4 Year Proactive Care Advanced 24x7 Workload Aware Security for Linux Advanced LTU Service

U5KA2E

HPE 5 Year Proactive Care Advanced 24x7 Workload Aware Security for Linux Advanced LTU Service

U5KA3E

Date

Version History

Action

Description of Change

06-Jan-2020

Version 9

Changed

Overview and Configuration Information sections were updated.

26-Aug-2019

Version 8

Changed

QuickSpecs was updated.

01-Jul-2019

Version 7

Added

What's is new & Ordering and Configuration section updated.

04-Feb-2019

Version 6

Changed

Ordering and Configuration section was updated.

Added

SKUS added in Ordering and Configuration section: U5JY6E, U5JY7E, U5JY8E, U5JY9E, U5JZ0E, U5JZ1E, U5JZ2E, U5JZ3E, U5JZ4E, U5JZ5E, U5JZ6E, U5JZ7E, U5JZ8E,U5JZ9E, U5KA0E, U5KA1E, U5KA2E, U5KA3E.

03-Dec-2018

Version 5

Changed

Overview, Product Highlights, and Technical Specifications sections were updated.

02-Jul-2018

Version 4

Changed

Product Highlights and Technical Specifications sections were updated.

04-Jun-2018

Version 3

Changed

Technical Specifications section was updated

05-Feb-2018

Version 2

Changed

Overview, Products Highlights, and Technical Specifications sections were updated.

04-Dec-2017

Version 1

Created

New QuickSpecs