BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

1.1 Purpose and Scope

NIST platform security: roots of trust, firmware and secure enclaves SP 800-147B
All changes in this version
first version loaded 1 Introduction part of 1

Title

Purpose and Scope

Control

This document provides guidelines for BIOS protections in server-class systems. It is the second in a series of publications on BIOS protections. The first document, SP800-147, BIOS Protection Guidelines , was released in April 2011 and provides guidelines for desktop and laptop systems deployed in enterprise environments.

Unauthorized modification of BIOS firmware by malicious software constitutes a significant threat because of the BIOS’s unique and privileged position within modern computer system architectures. Malicious BIOS modification could be part of a sophisticated, targeted attack on an organization—either a permanent denial of service (if the BIOS is corrupted) or a persistent malware presence (if the BIOS is implanted with malware).

The three core principles of BIOS protection outlined in NIST SP 800-147 for client systems— authenticated firmware updates, integrity protection, and non-bypassability of protection mechanisms— apply to server-class machines. However, the architectural and operational complexity in servers due to the need to remotely manage them makes it more difficult to implement BIOS security protections in the same manner as clients; the core reason for the increased difficulty is that servers typically possess multiple BIOS update mechanisms. In addition, some servers have one or more Service Processors (SPs). SPs perform various management functions for the hosts, which may include BIOS updates. This introduces the SP as a security-critical component, and thus this document includes guidelines for SPs that are part of the BIOS update process.

Boot firmware refers to software or firmware used to facilitate the hardware initialization process and transition control to the hypervisor or operating system. This publication uses the term BIOS as a generic, recognized term for system boot firmware in servers, including, but not limited to, boot firmware based on conventional BIOS, Extensible Firmware Interface (EFI) BIOS, and Unified Extensible Firmware Interface (UEFI) BIOS . The guidelines in this document include requirements on servers to mitigate the execution of malicious or corrupt BIOS code. They apply to BIOS firmware stored in the BIOS flash memory, including the BIOS code, the cryptographic keys that are part of the Root of Trust for Update (RTU), and static BIOS data. Device firmware that is stored with the system BIOS firmware and is updated by the same mechanism is considered part of the BIOS for the purposes of this document (e.g., Option ROMs embedded in the BIOS flash). These guidelines do not apply to other device firmware or Option ROMs stored elsewhere in a server, such as on an option card itself.

This guide is intended to provide server platform vendors with recommendations and guidelines for a secure BIOS update process. System administrators should consult Section 3.2 of NIST SP 800-147 for recommended best practices for managing BIOS in client and server systems.