BaselineWatch
15 requirements
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

NIST platform security: roots of trust, firmware and secure enclaves SP 800-147

15 requirements · published 2011-04-29
Changes in this version
All1 Introduction2 Background3 Load and Execute Additional Firmware Modules: The system BIOS executes additional4 Manual Recovery: To recover from a corrupt or malfunctioning system BIOS, many computer5 Automatic Recovery: Some computer systems are able to detect when the system BIOS has beenAppendix A Summary of Guidelines for System BIOS ImplementationsAppendix B GlossaryAppendix C Acronyms and AbbreviationsAppendix D References
RefTitleText
1 Introduction
1.1
in 1
 Authority The National Institute of Standards and Technology (NIST) developed this document in furtherance of its statutory responsibilities under the Federal Information Security Management Act (FISMA) of 2002, Public Law 107-347. NIST is responsib
1.2
in 1
 Purpose and Scope This document provides guidelines for preventing the unauthorized modification of Basic Input/Output System (BIOS) firmware on PC client systems. Unauthorized modification of BIOS firmware by malicious software constitutes a significant thr
1.3
in 1
 Audience The intended audience for this document includes BIOS and platform vendors, and information system security professionals who are responsible for managing the endpoint platforms’ security, secure boot processes, and hardware security module
1.4
in 1
 Document Structure The remainder of this document is organized into the following major sections:  Section 2 presents an overview of the BIOS and its role in the boot process, and identifies potential attacks against the BIOS in an operational environment.
2 Background Modern computers such as desktop and laptop computers contain program code that facilitates the hardware initialization process. The code is stored in non-volatile memory and is commonly referred to as boot firmware. The primary firmware us
2.1
in 2
 System BIOS The system BIOS is the first piece of software executed on the main central processing unit (CPU) when a computer is powered on. While the system BIOS was originally responsible for providing operating systems access to hardware, its primar
2.2
in 2
 Role of System BIOS in the Boot Process The primary function of the system BIOS is to initialize important hardware components and to load the operating system. This process is known as booting . The boot process of the system BIOS typically executes in the following stages: 1. E
3 Load and Execute Additional Firmware Modules: The system BIOS executes additional pieces of firmware that either extend the capabilities of the system BIOS or initialize other hardware components necessary for booting the system. These additional modules may be stored within the same flash memory as the system BIOS or th
4 Manual Recovery: To recover from a corrupt or malfunctioning system BIOS, many computer systems provide mechanisms to allow a user with physical presence during the boot process to replace the current system BIOS with a known good version and configuration.
5 Automatic Recovery: Some computer systems are able to detect when the system BIOS has been corrupted and recover from a backup firmware image stored in a separate storage location from the primary system BIOS (e.g., a second flash memory chip, a hidden partition on a hard drive). 2.4 Importance of BIOS Integrity As the first co
Appendix A Summary of Guidelines for System BIOS Implementations This appendix contains a summary of the secure BIOS update guidelines for system BIOS implementations found in Section 3.1. These guidelines are intended for platform vendors designing, implementing, or selecting a system BIOS implementatio
Appendix B Glossary Selected terms used in the publication are defined below. Basic Input/Output System (BIOS): In this publication, refers collectively to boot firmware based on the conventional BIOS, Extensible Firmware Interface (EFI), and the Unified Exte
Appendix C Acronyms and Abbreviations This appendix contains a list of selected acronyms and abbreviations used in the guide. ACPI Advanced Configuration and Power Interface BDS Boot Device Selection BIOS Basic Input/Output System CPU Central Processing Unit CRTM Core Root of
Appendix D References The list below provides references for this publication. [Duarte08] G. Duarte. “How Computers Boot Up.” 5 June 2008. http://www.duartes.org/gustavo/blog/post/how-computers-boot-up [EFI] EFI 1.10 Specification . Intel. 1 November 2003. htt

15 of 15.