BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

3.5.3 Secure Local Update

NIST platform security: roots of trust, firmware and secure enclaves SP 800-193
All changes in this version
first version loaded 3 Principles and Key Concepts part of 3.5

Title

Secure Local Update

Control

While this document recommends firmware updates be done through an authenticated update mechanism as described in Section 3.5.1 , some devices may also support a secure local update mechanism. These mechanisms instead authorize firmware updates through a process demonstrating unambiguous physical presence. A secure local update mechanism can be used, for example, to recover a corrupted firmware image that cannot be updated using an authenticated update or an automated recovery mechanism. The secure local update mechanism could also be used by a physically-present administrator to update to an earlier firmware image on a device that does not allow rollback.

To protect against remote attacks exploiting secure local update mechanisms, it is important that these mechanisms verify that a user has physically authorized the update. Remote mechanisms, such as interacting with a device or system via a remote console, do not satisfy this requirement for physical presence. Similarly, mechanisms that can be spoofed by malware running on the system or device do not satisfy this requirement. See Section 3.6.2 for more details.

However, note that devices that implement the secure local update mechanism are potentially vulnerable to attacks by rogue administrators or other attacks with physical access to the device or system. Additional physical, environmental and technical security measures are essential to protecting these devices, but they are beyond the scope of this document.