OCP SAFE：为异构数据中心基础设施启用 IBV 固件供应链安全.pdf

1、Stefano Righi,AMIOCP S.A.F.E.:Enabling IBV Firmware Supply Chain Security for a Heterogeneous Datacenter InfrastructureOCP S.A.F.E.:Enabling IBV Firmware Supply Chain Security for a Heterogeneous Datacenter InfrastructureStefano Righi,AMISECURITY1.Why OCP S.A.F.E.?2.OCP S.A.F.E.Overview3.OCP S.A.F.E

2、.Program4.Advantages for adopters5.Call to ActionOutlineData Centers host a variety of processing devices and peripheral componentseach running updatable firmware and softwareThere is a need to address complex security challenges in this constantly evolving ecosystemSecurity assurance must address:C

3、ode provenanceCode qualitySoftware supply chainReleases and patchesAvoid effort duplication through security audit transparencyStandardize security reviewsWhy OCP S.A.F.E.?Regulatory LandscapeEU Cyber Resilience Act-All Products with Digital Elements(PDEs)-To be enforced Q4 2027IEC 62443 4-2 Industr

4、ial Control Platforms-Resilient System ComponentsFDA guidelines and approval for medical equipmentEU GDPR Software/Firmware ResilienceOperational SecurityData Privacy and ProtectionPCI DSS 4.0Korea PIPAColombia Decree 338 of 2022South Africa FCSAAustralia ACSCTaiwan modaJapan JC StarJapan NISCIndia

5、PDPBPCI DSS 4.0Chinese Cybersecurity LawBrazil LGPD Centralized framework to ensure conformance and reliabilityObjectivity achieved through third party certifiedcertified providersHolistic approach instead of certification checklistS.A.F.E.standardizes security audits of hardware and softwarefocus o

6、n datacenter server componentsLayered onion approachevery component undergo security testing before being adopted downstreamIncremental process throughout product lifecycleonly deltas are reviewed in an update OCP S.A.F.E.OverviewFrameworkReview AreasSecurity Review Provider(SRP)Short Form Report(SF