Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

Guest Blog // Selected Security Content Provided By Intel
What's This?
1/21/2014
12:02 PM
Tom Quillin
Tom Quillin
Guest Blogs
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Machine Resiliency as a Defense

If you follow news on cyber security, you might be led to think PCs and endpoints have become increasingly vulnerable.

If you follow news on cyber security, you might be led to think PCs and endpoints have become increasingly vulnerable. News today describes more complex attacks, from more sophisticated attackers, than ever. But there is good news too. In 2014, the PC you unbox and provision on your network is likely to be a better machine, better able to withstand attack, more resilient than a PC of just a few years ago.

Those improvements are the result of efforts and investments in security assurance from OSVs, ISVs, OEMs and hardware suppliers. Let's take BIOS, for example. BIOS isn't often fodder for headlines, but it matters. BIOS is the low level firmware that controls machine operations before the OS takes control. Even less visible is the BIOS's contribution to system security in testing, verifying and authenticating the hardware to ensure it has not been compromised.

When BIOS was developed back in the 1970s, security goals were secondary. BIOS performed powerful but rudimentary startup and initialization functions. Modern BIOS has evolved into a more powerful interface properly known as Unified Extensible Firmware Interface (UEFI), with an industry standard setting organization (the UEFI Forum) supporting an ecosystem of hardware developers and implementers.

UEFI's most recent specification (UEFI 2.3.1) addresses resiliency and security features with the addition of Secure Boot. Secure Boot helps firmware, OS and hardware providers validate that each stage of system startup is loading authorized code. This approach helps impede malware, such as a rootkit that can replace the boot loader – even before the full defenses of the operating system and security software are up and running. UEFI Secure Boot can block unauthorized executables and drivers from loading into the system. If unauthorized software tries to load, UEFI halts the boot sequence. UEFI has worked hand-in-hand with industry-leading vendors to ensure wide-spread compatibility and adoption of Secure Boot.

These types of defenses get built into many modern PCs without your even having to worry about it. How does change like this happen? It's a great case study in technology leaders and competitors working together for the common good.

Over the past few years, the collaboration has extended. The National Institute of Standards and Technology (NIST) plays a key role in helping government-run IT organizations sort through emerging technology standards and helps government buyers understand what to look for as consumers of new technology.

In 2011 NIST published guidelines for enterprise-class platforms, specifying BIOS security features and best practices for BIOS implementation and configuration. While the guidance is primarily targeted and written for the benefit of government agencies, they are widely adopted by the private sector as well. You don't need to become an expert in assembly language to take advantage of these recommendations; they've been documented in a NIST Special Publication (NIST SP800-147) easily available on the NIST website.

There is much more to the story of how resiliency has been engineered into system defense, including the role of TPMs and detail about how modern operating systems help secure the boot process. We can't cover it all here, but if you are interested in finding out more take a look at some of these sites – or continue the conversation with a comment here.

UEFI Secure Boot In Modern Computer Security Solutions

BIOS Protection Guidelines

Follow me on Twitter: @TomQuillin

Tom Quillin is the Director of Cyber Security for Technologies and Initiatives at Intel Corp. He is responsible for identifying security risks, as well as contributing to product planning that addresses future security challenges. He also manages Intel's policy positions on ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
macker490
50%
50%
macker490,
User Rank: Ninja
1/27/2014 | 12:24:17 PM
re: Machine Resiliency as a Defense
you are simply moving the defense from the O/S to the BIOS and flash program. it will be necessary to enforce rule 1 for the BIOS and flash programming: authorized, signed updates only, and only via the approved procedure.

if you put that in the O/S you get the same thing.
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Enterprises are Attacking the Cybersecurity Problem
Concerns over supply chain vulnerabilities and attack visibility drove some significant changes in enterprise cybersecurity strategies over the past year. Dark Reading's 2021 Strategic Security Survey showed that many organizations are staying the course regarding the use of a mix of attack prevention and threat detection technologies and practices for dealing with cyber threats.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-41182
PUBLISHED: 2021-10-26
jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `altField` option is now t...
CVE-2021-41183
PUBLISHED: 2021-10-26
jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various `*Text` options are now al...
CVE-2021-41184
PUBLISHED: 2021-10-26
jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `of` option is now treated as a...
CVE-2021-41185
PUBLISHED: 2021-10-26
Mycodo is an environmental monitoring and regulation system. An exploit in versions prior to 8.12.7 allows anyone with access to endpoints to download files outside the intended directory. A patch has been applied and a release made. Users should upgrade to version 8.12.7. As a workaround, users may...
CVE-2021-41188
PUBLISHED: 2021-10-26
Shopware is open source e-commerce software. Versions prior to 5.7.6 contain a cross-site scripting vulnerability. This issue is patched in version 5.7.6. Two workarounds are available. Using the security plugin or adding a particular following config to the `.htaccess` file will protect against cro...