The Personal Data Protection Law (KVKK) in Turkey obliges all businesses to secure information systems harboring personal data. In accordance with the mandatory provisions of the law, data controllers are responsible for taking all necessary administrative and technical measures to prevent unlawful processing of and access to personal data. These technical measures, specified in the Personal Data Security Guide, directly target the physical and virtual server infrastructures where data is stored.
Dell PowerEdge servers, which form the backbone of corporate data centers and IT infrastructures, are the most critical focus of KVKK compliance due to the databases, ERP software, file servers, and e-mail systems they host. Failure to configure Dell servers in accordance with KVKK standards can lead to companies facing very heavy administrative fines and legal sanctions in case of potential data breaches. In this guide, we will discuss in detail the most critical steps you need to implement to make your Dell PowerEdge server infrastructure fully compliant with KVKK technical measures.
What Do KVKK Technical Measures on Dell Servers Cover?
According to the Personal Data Security Guide, technical measures to be taken at the server layer are mainly grouped under authorization, access control, encryption, logging, and backup. The advanced hardware and software features of Dell PowerEdge servers allow these measures to be implemented completely.
1. Authorization Matrix and Access Control (iDRAC and Operating System Security)
The first step of KVKK technical measures is to ensure that only those who need to access personal data due to their duties can access it.
- iDRAC Access Security: iDRAC (Integrated Dell Remote Access Controller), the remote management interface of Dell servers, is the management panel with the highest privileges. Default passwords (root/calvin) on iDRAC must be replaced with complex passwords during the installation phase.
- Role-Based Access Control (RBAC): Role-based authorization should be performed on iDRAC and the server operating system, giving IT personnel only as much authority as they need (the principle of Least Privilege).
- Two-Factor Authentication (2FA): Active Directory integration and two-factor authentication (2FA) mechanisms should be activated in iDRAC and server login processes.
2. Data Encryption (Encryption at Rest)
Encryption of data is a legal obligation against the risk of physical theft of disks where personal data is stored or capture by unauthorized persons.
- Dell PERC and SED Disks: PERC (PowerEdge RAID Controller) cards in Dell PowerEdge servers work integrated with Self-Encrypting Drives (SED) to offer hardware-level encryption.
- Key Management: Encryption keys must be stored in a secure key management server (KMIP compliant) outside the server. Thus, even if the disks are removed from the server, it becomes impossible to access the data inside them.
3. Log Management and Audit Records (Audit Logging)
Making all access, changes, and system movements regarding personal data traceable is one of the clearest demands of KVKK.
- iDRAC Lifecycle Controller Logs: All kinds of changes made on server hardware, login attempts, and system events are recorded by the Lifecycle Controller.
- Central Logging and SIEM: Dell server logs and operating system event logs should be forwarded in real-time to a central SIEM (Security Information and Event Management) system instead of being kept on local disks. The retrospective integrity of logs must be protected and stored in legal standards.
Professional Solutions for Your Dell Server Infrastructure
Configuring hardware encryption, access hardening, and secure deployment processes of your Dell PowerEdge servers in full compliance with KVKK requirements is a process that requires expertise. To establish your IT infrastructure in accordance with legal regulations and cybersecurity standards, you can benefit from our Server Installation, Configuration and Commissioning services.
To plan secure hardware investments needed by your business and to procure KVKK compliant Dell servers and storage systems, you can examine our Enterprise Server Hardware Sales and Supply Service solutions.
To professionally plan your IT infrastructure's legal compliance processes, risk analyses, and technology roadmap, you can work with our expert team within the scope of our Business and Management Consulting services.
You can also review our other guides that will strengthen your personal data protection and information security processes:
- For general changes required in IT infrastructure: IT Infrastructure for KVKK Compliance
- For KVKK compliant logging in virtual environments: How to Configure VMware Logging for KVKK?
- For secure destruction of personal data: Obligations of Deletion, Destruction, and Anonymization in KVKK
- For compliance of physical security and camera recordings: Camera Systems Within the Scope of KVKK
- For compliance processes of small-scale businesses: Small Business Guide for KVKK
- For integration of KVKK and ISO 27001 standards: KVKK and ISO 27001 Integration
- For ISO 27001 logging requirements of virtualization infrastructure: How to Configure VMware Logging for ISO 27001?
- For legal internet logging obligations: What is 5651 Logging, and for Whom is it Mandatory?
- For central logging and SIEM architectures: SIEM, Syslog, and 5651 Correct Architecture Design
- For the foundation of information security standards: What is ISO 27001?
To make your Dell server infrastructure fully compliant with KVKK technical measures, and to deploy hardware encryption and secure authentication systems, you can contact us at any time.
Frequently Asked Questions
Is it mandatory to use hardware encryption (SED) on Dell servers for KVKK?
Within the scope of KVKK technical measures, encryption of environments where personal data is stored is mandatory. You can do this via software at the operating system level (BitLocker, LUKS, etc.), or you can perform it by using hardware Self-Encrypting Drives (SED) on Dell servers. Hardware encryption is the most preferred method in KVKK compliance because it does not bring additional load to server performance and provides the highest level of security independently of the operating system.
How is KVKK compliant logging provided via the iDRAC panel?
iDRAC records all hardware and administrative events occurring on the server (logins, password changes, hardware additions/removals, etc.) under the Lifecycle Controller Log (LCL). For KVKK compliance, these logs must not remain on the server, and they must be forwarded securely using the Syslog protocol to a central SIEM or log server.
How should server backup be performed within the scope of KVKK technical measures?
KVKK requires the implementation of secure backup policies to prevent personal data from being lost in case of a potential cyber attack (e.g., Ransomware) or hardware failure. Personal data on Dell servers must be backed up regularly, backup media must be encrypted, and a copy of the backups must be stored in an environment isolated from the network (offline/immutable backup).
Conclusion
The complete implementation of KVKK technical measures in Dell PowerEdge server infrastructures is the most fundamental requirement for ensuring corporate data security and protecting against legal sanctions. Correctly designing authorization matrices, deploying hardware encryption (SED) technologies, and forwarding iDRAC and operating system logs securely to central SIEM systems protect your business against cyber threats while ensuring you successfully pass KVKK audits. A correctly configured server architecture secures personal data while maximizing your business continuity.