INTRODUCTION
The Federal Information Security Management Act (FISMA) defines the information security requirements for all federal agencies. FISMA spans the fundamental pillars of information security (confidentiality, integrity, and availability). It extends across the lifecycle of a security program from planning, implementation, and ongoing administration of a security program.
Firmware security has often been challenging for many organizations. Historically it has been time-consuming, required specialized and rare security skills, and teams often lacked the tools to automate the work. Fortunately, new tools and innovations are changing the situation for the better. In this brief we list the FISMA requirements and what actions we recommend to support them in your environment.
UNDERSTANDING THE FIRMWARE ATTACK SURFACE
Eclypsium Guidance and Considerations: Perform an initial firmware vulnerability assessment of critical devices or assets. Consider using licensed or open-source tools to automate the analysis of devices. Firmware analysis should include system-level firmware such as BIOS or UEFI, but should also extend to firmware of hardware components within the system such as drives, processors, and network adapters. Scans should be able to identify the following:
Systems with out of date firmware
Systems with firmware vulnerabilities
Systems with missing hardware protections
UNDERSTANDING DEVICE RISK AND IMPACT OF THREATS
Eclypsium Guidance and Considerations: Organizations may want to consider the impact of firmware-based threats to the following high-value devices during the categorization phase:
High-Value Laptops: While all devices are potentially subject to attacks on their firmware, laptops are exposed more often than other assets. An attacker with physical access to a device can compromise the firmware in 5 minutes. Thus organizations may want to consider firmware security controls for devices that carry high-value information and/or travel to untrusted environments.
Critical Servers: Firmware provides an ideal path to both steal data or deny access to it altogether. This is particularly true of high-value servers. With the complexity and quantity of components (baseboard management controllers, network cards, system firmware, etc.) securing servers that have high privilege and contain critical assets, can be unmanageable.
Networking and Security Gear: Recent large-scale Russian attacks have shown that networking gear presents a particularly powerful prize for attackers. By subverting the network infrastructure, attackers could easily read, manipulate, or even redirect content on the network. Likewise the very network controls charged with securing the network could be targets of attack.
| Control | Reference | Eclypsium Recommendation |
| SI—System and Information IntegritySI-2 Flaw RemediationSI-4 Information System MonitoringSI-7 Software, Firmware, and Information Integrity | In-the-wild implants (eg. HackingTeam, Lojax) | Confirm firmware integrityIdentify insecure firmware and apply updatesEnsure that all firmware updates are cryptographically signed and that devices require any firmware updates to be signedMonitor devices for signs of malicious firmware behaviorAnalyze systems to ensure the integrity of the boot process and boot firmwareDetect firmware threats such as implants, backdoors, and rootkits |
| SA—System and Services AcquisitionSA-12 Supply Chain ProtectionSA-19 Component Authenticity | Supply chain interdictions | Evaluate prospective technology for firmware security and avoid products that can be easily modified at the firmware levelCheck all newly acquired devices to confirm the integrity of the firmwareMonitor devices for signs of malicious firmware behavior |
| CM—Configuration ManagementCM-2 Baseline ConfigurationCM-5 Access Restrictions for ChangeCM-7 Least Functionality | Secure ConfigurationPLATINUM malware campaign | Record expected configuration and behavior of device firmware and hardwareActivate firmware and hardware security featuresAnalyze critical devices to ensure unnecessary features are disabled, particularly remote management interfaces that are not used |
| AC—Access ControlAC-6 Least Privilege | Firmware Storage Vulnerabilities | Ensure any unnecessary debug functionality is not enabledEnsure firmware storage is properly protected |
| RA—Risk AssessmentRA-5 Vulnerability Scanning | Firmware and hardware vulnerabilities (eg. Speculative execution side-channels, vulnerable firmware storage, insecure SMM code) | Prioritize the analysis and monitoring of firmware and hardware vulnerabilitiesRegular scans should be able to identifySystems with out of date firmwareSystems with firmware vulnerabilitiesSystems with missing protections |
| IR—Incident ResponseIR-4 Incident HandlingIR-10 Security Analysis Team | Attackers using firmware implants to persist across system re-imaging. | Perform firmware scans of devices related to incident to track scopeVerify integrity of firmware of all affected hosts during system recoveryArm staff with tools to assist in forensic analysis of firmware-based threats |
| MA—MaintenanceMA-3 Maintenance Tools | BMC, IPMI, and Intel AMT as potential attack vectors | Monitor management interfaces for vulnerabilities or signs of compromiseScan management resources for vulnerabilitiesOnly enable remote management tools for devices that have an operational need |
CONCLUSION
This document highlights some of the areas where firmware security can play an important role in FISMA compliance. Firmware security may have been overlooked in the past but with our work and others in the industry, this is changing. If you have any questions or concerns related to topics in this document, please contact the Eclypsium team at [email protected].
