Being a beginner in security and as part of one of my projects, I would like to determine what are the ways software might be vulnerable when deployed in in a specific scenario.

Let's say that Company A builds software and deploys it on a Dell R630 computer. This company rents that computer to a company B in their data center.

Company A would like to know what are the possible risks that this system is hacked on the spot.

Company A has access to ssh on the server behind a VPN.

After research, I found some local possible exploits on iDrac and I would like to know if it is possible to access the content of the HDD from Ethernet connectors or with another ways (Vflash media, usb...) without rebooting the server.

In this scenario, the HDD is encrypted and contains company A's software used by company B.

put on hold as too broad by Conor Mancone, forest, kasperd, ThoriumBR, Rory Alsop Oct 19 at 11:48

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    You are interested in law #3: blogs.technet.microsoft.com/rhalbheer/2011/06/16/… – Conor Mancone Oct 10 at 13:38
  • Wait, is the computer still in possession of Company A? Is company A physically sending the device to Company B? Or does Company A retain possession of the device and grant access to Company B via a remote/network connection? – Conor Mancone Oct 10 at 13:39
  • The company B holds a server. I totally agree with the law 3 but I still have to audit the possible threats – Hybrid Thoughts Oct 10 at 14:04
  • 1
    I think you need to be much more specific about what threats you are concerned about. Do you have copyrighted software you don't want them to copy? Do you have your own proprietary data you don't want them to steal? Without understanding why they are actually renting this computer there isn't much to say. If they are literally just renting a computer then there isn't really much to worry about at all - let them have full control and do what they want and then wipe and reinstall when it gets back. I'm guessing that is not your situation though... – Conor Mancone Oct 10 at 14:20
  • To be more precise, company A has developed a software that runs on the R630. Company B rents the server of company A in order to use this software (contained in the HDD of the R630). So I would like to know what are the best practices of security in this kind of case. For example is it possible to access an HDD from any server port with or without rebooting system. But if you know other examples, concept of security tests on other servers, it's also ok. – Hybrid Thoughts Oct 10 at 14:43