Security Overview
2023

Briefing to understand security implemented while collecting and processing performance metrics

The integrity of the Live Optics collector, security of the customer environment, and protection of customer data are issues of paramount concern in all elements of design of the Live Optics application. Security overrides all other concerns. As an example, manyfrequently-requested usability features have been rejected, as such features would compromise our strict security requirements.
Live Optics security areas can be divided into the following categories:- Collector Integrity- Collector Information-Gathering Protocols- Collector Live Optics Web Service Security- SIOKIT file security- Live Optics Web Application Security- Collector Security
Security begins with the Live Optics collectors. This section covers security issues
pertaining directly to the Live Optics collectors.

Collector Integrity
The Live Optics collectors are native binary executables for the Windows and Linux platforms. These executables run in customer environments, often at elevated privilege levels. Guaranteeing the integrity of these collectors is of critical concern.
With the introduction of Live Optics, Dell has moved the Live Optics collector download to a login-protected, HTTPS (SSL) download
link. By downloading the collectors directly, users know they are getting the collector directly from Dell. The Windows collector is
digitally signed by Dell. The collector’s internal meta-data is also signed to guarantee that the collector and the End User meta-data
identifying the collector has not been altered.

Collector Information-Gathering Protocols
As the collector gathers information from the target servers or hardware appliance, the security ramifications of the underlying protocols are scrutinized.
First, any credentials provided to the collector for remote server access are neverpersisted in any kind of file or sent back to Dell in any format. Credentials areencrypted in memory using OS-defined methods, in the event that the collector’smemory is paged to disk, or if the collector memory should otherwise be accessed.

In This Briefing

For local Windows collection, the collector uses Microsoft’s WMI protocols. For•

Collector Security•

Protocols Used•

Securing the Online
Analytics Portal

agentless, remote collection WMI use the Windows remote Kerberos authentication tosecurely access the remote systems.
Passwords are never transmitted in plain text.

© 2023 Dell

Security: continued
For remote Linux collection, the collector uses SSH to establish an encrypted secure shell with the target Unix system. The Windows collector only supports the latest SSH key exchange methods.
The Linux collector uses the SSH module installed on the system where the collector runs. We advise users to update their SSH and underlying OpenSSL libraries to the most recent libraries.
For VMware collection, Live Optics uses VMware’s SOAP based HTTPS API. This method uses HTTPS/SSL which is an encrypted communication stream. Live Optics uses the OpenSSL library for SSL communication. The library is updated routinely with the most recent updates
from the OpenSSL development team.

Live Optics Web Service API Communication
Live Optics communicates (optionally) with Live Optics analytics servers using a SOAP based HTTPS protocol. Additionally, the Live Optics
Web Service API requires SSL Client Certificate Authentication. The SSL Client Certificate is embedded into the Live Optics collector as apart of the signed meta-data including the collector build.

Live Optics SIOKIT File Security
Live Optics SIOKIT files are encrypted with 2048 bit RSA and 256-AES keys. The key pairs are generated per collector. The private keys aresecured within the Dell EMC Live Optics datacenter. The public keys are embedded into the collector.

Live Optics Web Application Security
The Live Optics web application was designed following the strict Dell EMC guidelines and has been scrutinized by both the internal Dell
EMC Security Team as well as outside security experts.
Access to the site is via the secure and encrypted HTTPS framework. Latest security patches are routinely applied to all Live Optics servers.
While we do not disclose the design of our environment, the Live Optics datacenter consists of multiple layers of firewalled servers andcommunication frameworks. Data is securely stored behind numerous firewalled networks.
Dell Security policy prevents us from listing the exact methods we use to secure the site, but we can disclose that the Dell Security teamroutinely runs numerous leading 3rd party security applications that scan both the site and source code for vulnerabilities.

Anonymizing Data At the Source
The design of the Live Optics program allows each End User to own their own data, yet share it to trusted technical consultants to collaborate in infrastructure decision making processes or support cases. Most often the data is sent “as is”, however, if one feels the need tomask server names by providing an alias then this can be accomplished in the collector itself prior to starting any data collection process.
To accomplish this you would use the /anon switch and start the collector from the command line. Similarly, in Linux/Unix variants you
would use -- anon.
This will provide source side randomization of all server name, LUNs, or any other information that might be unique to internal namingconventions.

A review of security measures implemented in Live Optics© 2023 Dell

Security: continued
Collection and Web Service Protocols
Live Optics uses the following protocols to gather information from the supported target platforms and communicate with Live Optics WebServices:

Microsoft Windows WMI
SSH
On Linux, the local ssh client is used
On Windows, a proprietary SSH stack implementation is used.
Used for remote Linux collection
Uses bash shell commands on the target system to collect data (screen scraping)

VMware vSphere SDK API
HTTPS/SOAP XML protocol for communicating with vCenter servers
Live Optics Web Services API Client
HTTP/SOAL XML protocol compatible with Microsoft WCF Web Services that communicates with the Live Optics Web Services.

Linux Collection Details
Wherever possible, Live Optics tries to read the kernel sysfs files directly to get information rather than relying on the user-spacetools. This is because the kernel file formats rarely change, while the user tools change frequently, making screen scraping difficult.
Such kernel files include:•/proc/net/dev•/sys/block/*•/dev/*/dev/mapper/*Whenever possible, Live Optics tries to use tools that typically do not require root privileges.
Live Optics uses a variety of bash and sh commands too numerous to list here.

A review of security measures implemented in Live Optics© 2023 Dell

Security: continued
Data Gathered by Live Optics during a Host or OS level scan
The collectors gather information about each hostsystem that they monitor:•

Operating System and version•

Hostname•

Domain Name of the server•

Date and time•

List of Installed Applications (optional)•

List of physical block devices (disks)•Advertised Capacity



Used Capacity

Serial Numbers (Shared Cluster Disk Information)

Negotiated Speed

CPU Configuration

Number of sockets



Number of cores

Clock speedModelServer Model

A review of security measures implemented in Live Optics© 2023 Dell••

List of network interfaces•

During the monitoring session, Live Optics collects stats for thefollowing:•

Disk performance

IOPS (reads/writes)MB/s Throughput (read/write)Avg. IO Size (reads/writes)Avg. Latency (reads/writes)Avg. Queue Depth

Server performance

Memory usage

Virtual Memory Hard Page Faults per sec



CPU usage

Network performance

Bytes receivedBytes sentWindows WMI Collection Details
For remote Windows collection, Live Optics uses Microsoft WMI. WMI is notoriously unreliable. In many cases, we have to run Live Optics
locally in order to bypass firewall and configuration issues associated with WMI. Live Optics uses the following WMI classes:•

Win32_ComputerSystem•

Win32_PerfFormattedData_PerfDisk_PhysicalDisk•

Win32_DiskDrivePhysicalMedia•

MSCluster_Disk•

Win32_DiskDriveToDiskPartition•

MSCluster_DiskPartition•

Win32_DiskPartition•

MSCluster_DiskToDiskPartition•

Win32_LogicalDisk•

StdRegProv•Win32_LogicalDiskToPartition•

Win32_NetworkAdapter•

Win32_NetworkAdpaterConfiguration•

Win32_OperatingSystem•

Win32_PerfRawData_PerfOS_Processor•

Win32_PerfRawData_Tcpip_NetworkInterface•

Win32_PhysicalMedia•

Win32_Processor•

Win32_SystemEnclosure•

Win32_PerfRawData_HvStats_HyperVHypervisorLogicalProcessor•

Win32_PerfRawData_PerfDisk_PhysicalDisk

A review of security measures implemented in Live Optics© 2023 Dell

Understanding more about Live Optics
The Live Optics team is happy to conduct local or online training.
Our contact information can be found on the right in the blue area below!
The Live Optics site is located at https://LiveOptics.com
The Live Optics support site is located at https://support.liveoptics.com or by emailing support@LiveOptics.com
The Live Optics support site also has a vast library of other insightful attributes of Live Optics and can be located here:
https://support.liveoptics.com/forums

Contact Us
The Live Optics team can be contacted at the following address:
General Manager:
Sam Kirchoff@SJKirchoff
Samuel.Kirchoff@Dell.com
Social Media@runLiveOptics#LiveOptics© 2023 Dell