Machine Resiliency as a Defense

If you follow news on cyber security, you might be led to think PCs and endpoints have become increasingly vulnerable. News today describes more complex attacks, from more sophisticated attackers, than ever. But there is good news too. In 2014, the PC you un-box and provision on your network is likely to be a better machine, better able to withstand attack, more resilient than a PC of just a few years ago.

Those improvements are the result of efforts and investments in security assurance from OSVs, ISVs, OEMs and hardware suppliers. Let’s take BIOS, for example. BIOS isn't often fodder for headlines, but it matters. BIOS is the low level firmware that controls machine operations before the OS takes control. Even less visible is the BIOS’s contribution to system security in testing, verifying and authenticating the hardware to ensure it has not been compromised.

UEFI

When BIOS was developed back in the 1970s, security goals were secondary. BIOS performed powerful but rudimentary start-up and initialization functions. Modern BIOS has evolved into a more powerful interface properly known as Unified Extensible Firmware Interface (UEFI), with an industry standard setting organization (the UEFI Forum)  supporting an ecosystem of hardware developers and implementers.

UEFI’s most recent specification (UEFI 2.3.1) addresses resiliency and security features with the addition of Secure Boot. Secure Boot helps firmware, OS and hardware providers validate that each stage of system start-up is loading authorized code. This approach helps impede malware, such as a rootkit that can replace the boot loader – even before the full defenses of the operating system and security software are up and running. UEFI Secure Boot can block unauthorized executables and drivers from loading into the system. If unauthorized software tries to load, UEFI halts the boot sequence. UEFI has worked hand-in-hand with industry-leading vendors to ensure wide-spread compatibility and adoption of Secure Boot.

These types of defenses get built into many modern PCs without your even having to worry about it. How does change like this happen? It’s a great case study in technology leaders and competitors working together for the common good.

NIST

Over the past few years, the collaboration has extended. The National Institute of Standards and Technology (NIST) plays a key role in helping government-run IT organizations sort through emerging technology standards and helps government buyers understand what to look for as consumers of new technology.

In 2011 NIST published guidelines for enterprise-class platforms, specifying BIOS security features and best practices for BIOS implementation and configuration.  While the guidance is primarily targeted and written for the benefit of government agencies, they are widely adopted by the private sector as well. You don’t need to become an expert in assembly language to take advantage of these recommendations; they've been documented in a NIST Special Publication (NIST SP800-147) easily available on the NIST website.

There is much more to the story of how resiliency has been engineered into system defense, including the role of TPMs and detail about how modern operating systems help secure the boot process. We can’t cover it all here, but if you are interested in finding out more take a look at some of these sites – or continue the conversation with a comment here.

NIST BIOS Protection Guidelines (PDF)

UEFI Secure Boot in Modern Computer Security Solutions (PDF)

Tom leads the team responsible for identifying and addressing Intel product security risks as well as planning products that solve tomorrow’s security challenges. The team also manages Intel’s policy positions on security and privacy. Beyond Intel, Tom has with worked with companies, organizations and government groups to identify and accelerate solutions that make computers safer from attack and easier to recover after an attack. Tom has helped Intel create its security and manageability strategy for business PCs, and he forged requirements among leading security and manageability software companies for Intel’s vPro technology products. Since joining Intel in 1998, he has led strategies focused on the accelerating innovation with customers and partners and improving collaboration in the PC supply chain. Tom earned his undergraduate degree at University of Iowa and an MBA from the University of Pennsylvania’s Wharton School of Business.

Connect with Tom on LinkedIn.

Follow Tom on Twitter.

Read previous content from Tom.

#ITCenter #ITSecurity