NIST platform security: roots of trust, firmware and secure enclaves SP 800-147B
All1 Introduction2 Background3 BIOS Security Principles4 Security Guidelines by Update Mechanism5 The RTU ensures that the BIOS flash memory is locked prior to transferring control to code
| Ref | Title | Text | |
|---|---|---|---|
| 2 | Background | This section provides background information on the system BIOS and types of server architectures. It identifies the primary methods used for updating the system BIOS, and it also discusses security issues and threats to the system BIOS. Fi | |
| 2.1 in 2 |
System BIOS | Exclusive of certain configuration and security code that may be embedded into a platform’s silicon components, e.g., processor, the system BIOS is the first software executed on the main central processing unit (CPU) when a computer is pow | |
| 2.2 in 2 |
Server Architectures | In this subsection, we differentiate servers into three classes: Basic Servers, Managed Servers, and Blade Servers. The distinctions made here have to do with the mechanisms employed to update the system BIOS. A Basic Server is architectura | |
| 2.3 in 2 |
System BIOS Update Mechanisms | The guidelines in this publication are intended to secure BIOS update mechanisms so that only authentic, authorized BIOS images are written to BIOS flash memory, a process sometimes referred to as “flashing” the image. While client systems | |
| 2.4 in 2 |
Threats to the System BIOS | A server is susceptible to the same forms of attack that threaten a client system. Execution of operating system-level malware on servers could precede a BIOS attack. Server BIOS updates that are executed without being authenticated as comi | |
| 2.5 in 2 |
Root of Trust for Update | A Root of Trust for Update (RTU) is an inherently trusted combination of hardware and firmware that performs a secure update of the BIOS and maintains the integrity of the BIOS. The RTU may comprise functionality for verifying digitally sig |
6 of 20.