Analytics // Threat Intelligence
Guest Blog // Selected Security Content Provided By Intel
What's This?
1/21/2014
12:02 PM
Tom Quillin
Tom Quillin
Guest Blogs
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Machine Resiliency as a Defense

If you follow news on cyber security, you might be led to think PCs and endpoints have become increasingly vulnerable.

If you follow news on cyber security, you might be led to think PCs and endpoints have become increasingly vulnerable. News today describes more complex attacks, from more sophisticated attackers, than ever. But there is good news too. In 2014, the PC you unbox and provision on your network is likely to be a better machine, better able to withstand attack, more resilient than a PC of just a few years ago.

Those improvements are the result of efforts and investments in security assurance from OSVs, ISVs, OEMs and hardware suppliers. Let's take BIOS, for example. BIOS isn't often fodder for headlines, but it matters. BIOS is the low level firmware that controls machine operations before the OS takes control. Even less visible is the BIOS's contribution to system security in testing, verifying and authenticating the hardware to ensure it has not been compromised.

When BIOS was developed back in the 1970s, security goals were secondary. BIOS performed powerful but rudimentary startup and initialization functions. Modern BIOS has evolved into a more powerful interface properly known as Unified Extensible Firmware Interface (UEFI), with an industry standard setting organization (the UEFI Forum) supporting an ecosystem of hardware developers and implementers.

UEFI's most recent specification (UEFI 2.3.1) addresses resiliency and security features with the addition of Secure Boot. Secure Boot helps firmware, OS and hardware providers validate that each stage of system startup is loading authorized code. This approach helps impede malware, such as a rootkit that can replace the boot loader – even before the full defenses of the operating system and security software are up and running. UEFI Secure Boot can block unauthorized executables and drivers from loading into the system. If unauthorized software tries to load, UEFI halts the boot sequence. UEFI has worked hand-in-hand with industry-leading vendors to ensure wide-spread compatibility and adoption of Secure Boot.

These types of defenses get built into many modern PCs without your even having to worry about it. How does change like this happen? It's a great case study in technology leaders and competitors working together for the common good.

Over the past few years, the collaboration has extended. The National Institute of Standards and Technology (NIST) plays a key role in helping government-run IT organizations sort through emerging technology standards and helps government buyers understand what to look for as consumers of new technology.

In 2011 NIST published guidelines for enterprise-class platforms, specifying BIOS security features and best practices for BIOS implementation and configuration. While the guidance is primarily targeted and written for the benefit of government agencies, they are widely adopted by the private sector as well. You don't need to become an expert in assembly language to take advantage of these recommendations; they've been documented in a NIST Special Publication (NIST SP800-147) easily available on the NIST website.

There is much more to the story of how resiliency has been engineered into system defense, including the role of TPMs and detail about how modern operating systems help secure the boot process. We can't cover it all here, but if you are interested in finding out more take a look at some of these sites – or continue the conversation with a comment here.

UEFI Secure Boot In Modern Computer Security Solutions

BIOS Protection Guidelines

Follow me on Twitter: @TomQuillin

Tom Quillin is the Director of Cyber Security for Technologies and Initiatives at Intel Corp. He is responsible for identifying security risks, as well as contributing to product planning that addresses future security challenges. He also manages Intel's policy positions on ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
macker490
50%
50%
macker490,
User Rank: Ninja
1/27/2014 | 12:24:17 PM
re: Machine Resiliency as a Defense
you are simply moving the defense from the O/S to the BIOS and flash program. it will be necessary to enforce rule 1 for the BIOS and flash programming: authorized, signed updates only, and only via the approved procedure.

if you put that in the O/S you get the same thing.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-5395
Published: 2014-11-21
Multiple cross-site request forgery (CSRF) vulnerabilities in Huawei HiLink E3276 and E3236 TCPU before V200R002B470D13SP00C00 and WebUI before V100R007B100D03SP01C03, E5180s-22 before 21.270.21.00.00, and E586Bs-2 before 21.322.10.00.889 allow remote attackers to hijack the authentication of users ...

CVE-2014-7137
Published: 2014-11-21
Multiple SQL injection vulnerabilities in Dolibarr ERP/CRM before 3.6.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) contactid parameter in an addcontact action, (2) ligne parameter in a swapstatut action, or (3) project_ref parameter to projet/tasks/contact.php; (4...

CVE-2014-7871
Published: 2014-11-21
SQL injection vulnerability in Open-Xchange (OX) AppSuite before 7.4.2-rev36 and 7.6.x before 7.6.0-rev23 allows remote authenticated users to execute arbitrary SQL commands via a crafted jslob API call.

CVE-2014-8090
Published: 2014-11-21
The REXML parser in Ruby 1.9.x before 1.9.3 patchlevel 551, 2.0.x before 2.0.0 patchlevel 598, and 2.1.x before 2.1.5 allows remote attackers to cause a denial of service (CPU and memory consumption) a crafted XML document containing an empty string in an entity that is used in a large number of nes...

CVE-2014-8469
Published: 2014-11-21
Cross-site scripting (XSS) vulnerability in Guests/Boots in AdminCP in Moxi9 PHPFox before 4 Beta allows remote attackers to inject arbitrary web script or HTML via the User-Agent header.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?