BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

4.2.1.2 Integrity Protection

NIST platform security: roots of trust, firmware and secure enclaves SP 800-193
All changes in this version
first version loaded 4 Firmware Security Guidelines for Platform Devices part of 4.2.1

Title

Integrity Protection

Control

To prevent unintended or malicious modification of the firmware, nonvolatile storage regions containing device firmware need to be protected from such modifications outside of an authorized update mechanism.

1) The flash regions that contain device firmware shall be protected so that it is modifiable only through an authenticated update mechanism or by a secure local update mechanism that ensures the authenticity and integrity of the firmware update image by requiring that an authorized user physically touch the system itself to conduct the update. Note: To ensure integrity protections cannot be bypassed, integrity protections must either always be enabled, or must be engaged prior to execution of code outside of the CTU. Hardware integrity mechanisms may provide higher assurance than software or firmware-based mechanisms. These integrity protection mechanisms must ensure that firmware can only be modified as part of an authenticated update, or a secure local update.