BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

1.1 Purpose

NIST platform security: roots of trust, firmware and secure enclaves SP 800-193
All changes in this version
first version loaded 1 Introduction part of 1

Title

Purpose

Control

Modern computing and information technology systems are built upon a variety of hardware components that provide the fundamental capabilities required by the system to operate. Many of these hardware components have firmware and configuration data that drive their behavior, and which must remain in a state with integrity in order for the system to function properly. One example of such firmware is commonly referred to as the Basic Input/Output System (BIOS), which is used to facilitate the hardware initialization process and transition control to the operating system. Depending on the system, there may be tens or hundreds of microcontrollers with other kinds of programmable firmware which support the overall system architecture. That collection of hardware and firmware components is typically called the platform .

The devices which make up the platform are crucial to integrity and availability of the systems built upon the platform. Without these devices, systems may fail to operate correctly, or may not operate at all. Targeted attacks at certain devices within the platform could significantly impact the security posture of these systems, possibly allowing a low-level, persistent malware presence. Attacks which aim to damage or remove platform firmware have the potential to render systems permanently damaged, incurring substantial costs to the affected parties.

The purpose of this document is to provide security guidelines to support system resiliency at a platform level. As defined by the International Council of Systems Engineering (INCOSE), system resilience is “the capability of a system with specific characteristics before, during and after a disruption to absorb the disruption, recover to an acceptable level of performance, and sustain that level for an acceptable period of time.” [10] Applied to information systems, cyber resiliency is “ability to anticipate, withstand, recover from, and adapt to adverse conditions, stresses, attacks, or compromises on systems that include cyber resources.” While guidelines on cyber resiliency at a system level are described in draft NIST Special Publication 800-160, Volume 2, this publication notes that system-level resiliency should be supported by foundational security capabilities in computer platforms. The guidelines in this document support cyber resiliency by specifying mechanisms that protect firmware and configuration data from attacks, and that can detect and recover from successful attacks.