Analytics // Threat Intelligence
Guest Blog // Selected Security Content Provided By Intel
What's This?
1/21/2014
12:02 PM
Tom Quillin
Tom Quillin
Guest Blogs
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Machine Resiliency as a Defense

If you follow news on cyber security, you might be led to think PCs and endpoints have become increasingly vulnerable.

If you follow news on cyber security, you might be led to think PCs and endpoints have become increasingly vulnerable. News today describes more complex attacks, from more sophisticated attackers, than ever. But there is good news too. In 2014, the PC you unbox and provision on your network is likely to be a better machine, better able to withstand attack, more resilient than a PC of just a few years ago.

Those improvements are the result of efforts and investments in security assurance from OSVs, ISVs, OEMs and hardware suppliers. Let's take BIOS, for example. BIOS isn't often fodder for headlines, but it matters. BIOS is the low level firmware that controls machine operations before the OS takes control. Even less visible is the BIOS's contribution to system security in testing, verifying and authenticating the hardware to ensure it has not been compromised.

When BIOS was developed back in the 1970s, security goals were secondary. BIOS performed powerful but rudimentary startup and initialization functions. Modern BIOS has evolved into a more powerful interface properly known as Unified Extensible Firmware Interface (UEFI), with an industry standard setting organization (the UEFI Forum) supporting an ecosystem of hardware developers and implementers.

UEFI's most recent specification (UEFI 2.3.1) addresses resiliency and security features with the addition of Secure Boot. Secure Boot helps firmware, OS and hardware providers validate that each stage of system startup is loading authorized code. This approach helps impede malware, such as a rootkit that can replace the boot loader – even before the full defenses of the operating system and security software are up and running. UEFI Secure Boot can block unauthorized executables and drivers from loading into the system. If unauthorized software tries to load, UEFI halts the boot sequence. UEFI has worked hand-in-hand with industry-leading vendors to ensure wide-spread compatibility and adoption of Secure Boot.

These types of defenses get built into many modern PCs without your even having to worry about it. How does change like this happen? It's a great case study in technology leaders and competitors working together for the common good.

Over the past few years, the collaboration has extended. The National Institute of Standards and Technology (NIST) plays a key role in helping government-run IT organizations sort through emerging technology standards and helps government buyers understand what to look for as consumers of new technology.

In 2011 NIST published guidelines for enterprise-class platforms, specifying BIOS security features and best practices for BIOS implementation and configuration. While the guidance is primarily targeted and written for the benefit of government agencies, they are widely adopted by the private sector as well. You don't need to become an expert in assembly language to take advantage of these recommendations; they've been documented in a NIST Special Publication (NIST SP800-147) easily available on the NIST website.

There is much more to the story of how resiliency has been engineered into system defense, including the role of TPMs and detail about how modern operating systems help secure the boot process. We can't cover it all here, but if you are interested in finding out more take a look at some of these sites – or continue the conversation with a comment here.

UEFI Secure Boot In Modern Computer Security Solutions

BIOS Protection Guidelines

Follow me on Twitter: @TomQuillin

Tom is responsible for identifying and addressing Intel product security risks as well as planning products that solve tomorrow's security challenges and also manages Intel's policy positions on security and privacy. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
macker490
50%
50%
macker490,
User Rank: Ninja
1/27/2014 | 12:24:17 PM
re: Machine Resiliency as a Defense
you are simply moving the defense from the O/S to the BIOS and flash program. it will be necessary to enforce rule 1 for the BIOS and flash programming: authorized, signed updates only, and only via the approved procedure.

if you put that in the O/S you get the same thing.
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0640
Published: 2014-08-20
EMC RSA Archer GRC Platform 5.x before 5.5 SP1 allows remote authenticated users to bypass intended restrictions on resource access via unspecified vectors.

CVE-2014-0641
Published: 2014-08-20
Cross-site request forgery (CSRF) vulnerability in EMC RSA Archer GRC Platform 5.x before 5.5 SP1 allows remote attackers to hijack the authentication of arbitrary users.

CVE-2014-2505
Published: 2014-08-20
EMC RSA Archer GRC Platform 5.x before 5.5 SP1 allows remote attackers to trigger the download of arbitrary code, and consequently change the product's functionality, via unspecified vectors.

CVE-2014-2511
Published: 2014-08-20
Multiple cross-site scripting (XSS) vulnerabilities in EMC Documentum WebTop before 6.7 SP1 P28 and 6.7 SP2 before P14 allow remote attackers to inject arbitrary web script or HTML via the (1) startat or (2) entryId parameter.

CVE-2014-2515
Published: 2014-08-20
EMC Documentum D2 3.1 before P24, 3.1SP1 before P02, 4.0 before P11, 4.1 before P16, and 4.2 before P05 does not properly restrict tickets provided by D2GetAdminTicketMethod and D2RefreshCacheMethod, which allows remote authenticated users to gain privileges via a request for a superuser ticket.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Three interviews on critical embedded systems and security, recorded at Black Hat 2014 in Las Vegas.