BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

3.1 Principles Supporting Platform Resiliency

NIST platform security: roots of trust, firmware and secure enclaves SP 800-193
All changes in this version
first version loaded 3 Principles and Key Concepts part of 3

Title

Principles Supporting Platform Resiliency

Control

The security guidelines in this document are based on the following three principles:

• Protection: Mechanisms for ensuring that Platform Firmware code and critical data remain in a state of integrity and are protected from corruption, such as the process for ensuring the authenticity and integrity of firmware updates.

• Detection: Mechanisms for detecting when Platform Firmware code and critical data have been corrupted or otherwise changed from an authorized state.

• Recovery: Mechanisms for restoring Platform Firmware code and critical data to a state of integrity in the event that any such firmware code or critical data are detected to have been corrupted, or when forced to recover through an authorized mechanism. Recovery is limited to the ability to recover firmware code and critical data.

The technical guidelines found in Section 4 are organized around these principles. The first principle, protection, is similar in scope and purpose to the guidelines found in NIST SP 800- 147, BIOS Protection Guidelines [1] . The basic principle of protection is expanded in this document to apply to a broader set of firmware and configuration data within the platform.

While protection mechanisms are intended to prevent destructive or malicious attacks against platform firmware and critical data, these mechanisms may be imperfect or impractical to implement on all categories of devices. In those cases, detection and recovery mechanisms are intended to discover and remediate attacks to regain normal and secure operation on the device.