Analytics // Threat Intelligence
Guest Blog // Selected Security Content Provided By Intel
What's This?
1/21/2014
12:02 PM
Tom Quillin
Tom Quillin
Guest Blogs
Connect Directly
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Machine Resiliency as a Defense

If you follow news on cyber security, you might be led to think PCs and endpoints have become increasingly vulnerable.

If you follow news on cyber security, you might be led to think PCs and endpoints have become increasingly vulnerable. News today describes more complex attacks, from more sophisticated attackers, than ever. But there is good news too. In 2014, the PC you unbox and provision on your network is likely to be a better machine, better able to withstand attack, more resilient than a PC of just a few years ago.

Those improvements are the result of efforts and investments in security assurance from OSVs, ISVs, OEMs and hardware suppliers. Let's take BIOS, for example. BIOS isn't often fodder for headlines, but it matters. BIOS is the low level firmware that controls machine operations before the OS takes control. Even less visible is the BIOS's contribution to system security in testing, verifying and authenticating the hardware to ensure it has not been compromised.

When BIOS was developed back in the 1970s, security goals were secondary. BIOS performed powerful but rudimentary startup and initialization functions. Modern BIOS has evolved into a more powerful interface properly known as Unified Extensible Firmware Interface (UEFI), with an industry standard setting organization (the UEFI Forum) supporting an ecosystem of hardware developers and implementers.

UEFI's most recent specification (UEFI 2.3.1) addresses resiliency and security features with the addition of Secure Boot. Secure Boot helps firmware, OS and hardware providers validate that each stage of system startup is loading authorized code. This approach helps impede malware, such as a rootkit that can replace the boot loader – even before the full defenses of the operating system and security software are up and running. UEFI Secure Boot can block unauthorized executables and drivers from loading into the system. If unauthorized software tries to load, UEFI halts the boot sequence. UEFI has worked hand-in-hand with industry-leading vendors to ensure wide-spread compatibility and adoption of Secure Boot.

These types of defenses get built into many modern PCs without your even having to worry about it. How does change like this happen? It's a great case study in technology leaders and competitors working together for the common good.

Over the past few years, the collaboration has extended. The National Institute of Standards and Technology (NIST) plays a key role in helping government-run IT organizations sort through emerging technology standards and helps government buyers understand what to look for as consumers of new technology.

In 2011 NIST published guidelines for enterprise-class platforms, specifying BIOS security features and best practices for BIOS implementation and configuration. While the guidance is primarily targeted and written for the benefit of government agencies, they are widely adopted by the private sector as well. You don't need to become an expert in assembly language to take advantage of these recommendations; they've been documented in a NIST Special Publication (NIST SP800-147) easily available on the NIST website.

There is much more to the story of how resiliency has been engineered into system defense, including the role of TPMs and detail about how modern operating systems help secure the boot process. We can't cover it all here, but if you are interested in finding out more take a look at some of these sites – or continue the conversation with a comment here.

UEFI Secure Boot In Modern Computer Security Solutions

BIOS Protection Guidelines

Follow me on Twitter: @TomQuillin

Tom is responsible for identifying and addressing Intel product security risks as well as planning products that solve tomorrow's security challenges and also manages Intel's policy positions on security and privacy. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
macker490
50%
50%
macker490,
User Rank: Ninja
1/27/2014 | 12:24:17 PM
re: Machine Resiliency as a Defense
you are simply moving the defense from the O/S to the BIOS and flash program. it will be necessary to enforce rule 1 for the BIOS and flash programming: authorized, signed updates only, and only via the approved procedure.

if you put that in the O/S you get the same thing.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3090
Published: 2014-09-23
IBM Rational ClearCase 7.1 before 7.1.2.15, 8.0.0 before 8.0.0.12, and 8.0.1 before 8.0.1.5 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.

CVE-2014-3101
Published: 2014-09-23
The login form in the Web component in IBM Rational ClearQuest 7.1 before 7.1.2.15, 8.0.0 before 8.0.0.12, and 8.0.1 before 8.0.1.5 does not insert a delay after a failed authentication attempt, which makes it easier for remote attackers to obtain access via a brute-force attack.

CVE-2014-3103
Published: 2014-09-23
The Web component in IBM Rational ClearQuest 7.1 before 7.1.2.15, 8.0.0 before 8.0.0.12, and 8.0.1 before 8.0.1.5 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http...

CVE-2014-3104
Published: 2014-09-23
IBM Rational ClearQuest 7.1 before 7.1.2.15, 8.0.0 before 8.0.0.12, and 8.0.1 before 8.0.1.5 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.

CVE-2014-3105
Published: 2014-09-23
The OSLC integration feature in the Web component in IBM Rational ClearQuest 7.1 before 7.1.2.15, 8.0.0 before 8.0.0.12, and 8.0.1 before 8.0.1.5 provides different error messages for failed login attempts depending on whether the username exists, which allows remote attackers to enumerate account n...

Best of the Web
Dark Reading Radio