UEFI System Utilities security setting recommendations

hpe.com/psnow/resources/ebooks/a00018320en_us_v10/GUID-E80ABAD1-C361-4782-A2BF-D4AE26630FB3.html

Hewlett Packard Enterprise recommends the following UEFI System Utilities settings. For details about these
settings, see the UEFI System Utilities online help or the UEFI System Utilities User Guide for HPE ProLiant
Gen10, ProLiant Gen10 Plus Servers, and HPE Synergy. If a setting is not listed with a recommendation,
determine the appropriate value based on your environment and security priorities.

Set Power On Password

Set a password that is compliant with strong security standards.

Set Admin Password

Set a password that is compliant with strong security standards.

Secure Boot settings

Attempt Secure Boot—Enabled

Secure Boot requires UEFI boot mode.

TLS (HTTPS) Advanced Security Settings

Cipher suites allowed for TLS connections—Select the allowed ciphers for TLS connections

Certificate validation for every TLS connection—Peer

Strict Hostname checking—Enable

TLS Protocol Version Support—Auto

Processor AES-NI Support

Enabled

Trusted Platform Module Options

TPM 2.0 Operation—No Action

TPM Mode Switch Operation—TPM 2.0

TPM 2.0 Visibility—Visible

TPM UEFI Option ROM Measurement—Enabled

SATA Controller Options

Embedded SATA Configuration—To support SATA secure erase, this option must be set to SATA AHCI
Support and the installed SATA drives must support the secure erase command.

1/2
 SATA Secure Erase—Enable this option to allow SATA secure erase functions to work. This control
does not start the secure erase function.

Intel Security Options

Intel TXT Support—Enabled, if available.

Advanced Security Options

One-Time Boot Menu (F11 Prompt)—Disabled

Intelligent Provisioning (F10 Prompt)—Enabled

Backup ROM Image Authentication—Enabled

iLO 5 Configuration Utility

iLO 5 Functionality—Enabled

iLO 5 Configuration Utility—Enabled

Require user login and configuration privilege for iLO 5 Configuration—Enabled

Show iLO 5 IP Address during POST—Enabled

Local Users—Enabled

Serial CLI Status—Enabled

Serial CLI Speed (bits/second)—As appropriate for your environment

iLO Web Interface—Enabled

2/2