NIST Protects BIOS With New Security Guidelines

The standards body provides ways to detect changes to the code or configuration of a PCs startup system.

Slideshow: Government Innovators (clickimage for larger view and for full slideshow)
The organization that sets federal technology standards has provided new security guidelines for protecting the system that starts up PCs.
The National Institute for Standards and Technology (NIST) is accepting comments on
new guidelines
to lock down a computers Basic Input/Output System (BIOS), which--because it is a very basic, low-level function--can cause a significant security threat if unauthorized changes are made to it, according to NIST.
The document, BIOS Integrity Measurement Guidelines, provides “integrity measurement mechanisms” that have two aims, according to
NIST
. One is to detect changes to the BIOS code that could allow malicious software to run during a PCs boot process, and the other is to detect changes to the configuration of the system.
The document provides several use-case scenarios associated with BIOS functions that inform the security recommendations presented in the document.
The uses cases include installing and/or verifying the correct BIOS revision for a given client; imaging the BIOS with appropriate settings; setting BIOS passwords; asserting security controls requiring physical presence, including a PCs
Trusted Platform Module
; and registering the endpoint identity and integrity metrics in the pertinent IT databases, according to the document.
[The National Institute for Standards and Technology also has been busy building a cloud roadmap for government. See
NIST Releases Federal Cloud Roadmap, Architecture
.]
The guidelines--the second in a series aimed at locking down a PCs startup system--are aimed at hardware and software vendors developing products to support BIOS integrity measurement mechanisms, as well as organizations developing these types of security technologies, according to NIST.
The standards organization published the first in its series of BIOS security guidelines in April. That document, BIOS Protection Guidelines, provided ways for computer manufacturers to build security features directly into the BIOS to prevent unauthorized modifications.
Those interested have until Jan. 20, 2012 to comment on the most recent BIOS guidelines, NIST said.
Database access controls keep information out of the wrong hands. Limit who sees what to stop leaks--accidental and otherwise. Also in the new, all-digital Dark Reading supplement: Why user provisioning isnt as simple as it sounds.
Download the supplement now
. (Free registration required.)

Last News
▸ Scan suggests Heartbleed patches may not have been successful. ◂ Discovered: 23/12/2024 Category: security	▸ IoT Devices on Average Have 25 Vulnerabilities ◂ Discovered: 23/12/2024 Category: security	▸ DHS-funded SWAMP scans code for bugs. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
NIST Protects BIOS With New Security Guidelines