NSA publishes guidance on UEFI Secure Boot customization

guest · Sep 17, 2020

NSA publishes guidance on UEFI Secure Boot customization
September 16, 2020
https://securityaffairs.co/wordpress/108367/security/nsa-uefi-secure-boot-customization.html

The United States National Security Agency (NSA) has published guidance on how the Unified Extensible Firmware Interface (UEFI) Secure Boot feature that can be customized organizations.

The Unified Extensible Firmware Interface (UEFI) is a specification that defines a software interface between an operating system and platform firmware.
UEFI can support remote diagnostics and repair of computers, even with no operating system installed.

Over the years, experts observed several attacks employing rootkits that were specifically developed to target the firmware to achieve persistence and bypassing security solutions.
Click to expand...

The Secure Boot mechanism allows the execution of only software that is trusted by the Original Equipment Manufacturer (OEM).

“Secure Boot can be customized to meet the needs of different environments. Customization enables administrators to realize the benefits of boot malware defenses, insider threat mitigations, and data-at-rest protections.”states the NSA technical report. “Administrators should opt to customize Secure Boot rather than disable it for compatibility reasons.”
NSA report revealed that several organizations often disable Secure Boot for incompatibility issues, but the Agency strongly recommends customizing it to meet the needs of the organization.
Click to expand...

The NSA pointed out that the Secure Boot can be configured to audit firmware modules, expansion devices, and bootable OS images (sometimes referred to as Thorough Mode). The report states that Trusted Platform Module (TPM) may be used to validate the integrity of UEFI Secure Boot.
Click to expand...

National Security Agency | Cybersecurity Technical Report: "UEFI Secure Boot Customization"
(PDF - 1.65 MB): https://media.defense.gov/2020/Sep/15/2002497594/-1/-1/0/CTR-UEFI-SECURE-BOOT-CUSTOMIZATION-20200915.PDF/CTR-UEFI-SECURE-BOOT-CUSTOMIZATION-20200915.PDF

Log in or Sign up

NSA publishes guidance on UEFI Secure Boot customization

guest Guest

Log in or Sign up

NSA publishes guidance on UEFI Secure Boot customization

guest Guest

Useful Searches