NIST SP800-147：云计算决策指南与 BIOS 保护推荐

需积分: 10 49 浏览量更新于2024-07-16 收藏 924KB PDF 举报

"NIST SP800-147.pdf" 文件是美国国家标准与技术研究院（NIST）发布的一份关于云计算技术的指导性文件。这份特别出版物旨在以通俗易懂的方式解释云计算这一新兴领域，并为信息技术决策者提供实用的建议。由于云计算仍处于快速发展阶段，其潜在优势和劣势尚未得到充分的研究、文档化和验证，因此，该文档着重于指出何时以及如何适当地利用云服务，同时揭示了当前知识的局限性和未来进一步探讨的必要区域。文档的核心关注点在于生物启动加载程序（BIOS）保护的指导原则，这是计算机安全的重要组成部分。BIOS，即基本输入输出系统，是计算机启动时运行的第一批程序，确保硬件和操作系统之间的交互。在云计算环境下，保护BIOS免受攻击至关重要，因为这直接影响到数据安全和系统的稳定性。 NIST SP800-147给出了针对云计算环境下BIOS保护的具体推荐，包括但不限于： 1. **评估风险**：根据组织的特定需求和威胁环境，评估将业务流程迁移到云时BIOS安全的风险程度。 2. **选择合适的云服务提供商**：确保服务商有适当的安全措施来保护BIOS，例如物理隔离、加密和访问控制机制。 3. **实施访问控制**：对BIOS管理权限进行严格的访问控制，仅授权给有需要的人员，并限制远程访问。 4. **备份和恢复策略**：制定适当的备份策略，以应对可能的BIOS损坏或丢失，并测试恢复流程的有效性。 5. **持续监控和审计**：定期监控和审计云环境中的BIOS活动，及时发现并应对潜在问题。 6. **教育和培训**：提升员工对于云计算环境中BIOS安全的认识，确保他们遵循最佳实践。 7. **标准和框架**：遵循现有的NIST和其他行业标准，如CIS (Center for Internet Security) 的云安全框架，来加强云BIOS保护。 8. **未来研究方向**：虽然NIST提供了当前的指导，但鉴于云计算技术的快速变化，文件还强调了未来对云计算技术、特别是BIOS保护领域的持续研究和分析的重要性。 NIST SP800-147为组织在采用云计算时如何明智地处理BIOS安全问题提供了明确的路径，同时也提醒人们在享受云计算带来的便利的同时，不应忽视对传统系统关键部分的保护。这份指南对于保障云计算环境中信息系统的整体安全性具有实际价值。

BIOS PROTECTION GUIDELINES

Table of Contents

Executive Summary ....................................................................................................................1!

1.! Introduction.......................................................................................................................1-1!

1.1! Authority ...................................................................................................................1-1!

1.2! Purpose and Scope..................................................................................................1-1!

1.3! Audience ..................................................................................................................1-2!

1.4! Document Structure .................................................................................................1-2!

2.! Background.......................................................................................................................2-1!

2.1! System BIOS............................................................................................................2-1!

2.2! Role of System BIOS in the Boot Process ...............................................................2-1!

2.2.1! Conventional BIOS Boot Process.................................................................2-2!

2.2.2! UEFI Boot Process .......................................................................................2-4!

2.3! Updating the System BIOS ......................................................................................2-5!

2.4! Importance of BIOS Integrity ....................................................................................2-5!

2.5! Threats to the System BIOS.....................................................................................2-6!

3.! Threat Mitigation...............................................................................................................3-1!

3.1! Security Guidelines for System BIOS Implementations ...........................................3-1!

3.1.1! BIOS Update Authentication.........................................................................3-1!

3.1.2! Secure Local Update ....................................................................................3-2!

3.1.3! Integrity Protection........................................................................................3-2!

3.1.4! Non-Bypassability.........................................................................................3-3!

3.2! Recommended Practices for BIOS Management.....................................................3-3!

List of Appendices

Appendix A— Summary of Guidelines for System BIOS Implementations ...................... A-1!

Appendix B— Glossary .......................................................................................................... B-1!

Appendix C— Acronyms and Abbreviations........................................................................ C-1!

Appendix D— References ...................................................................................................... D-1!

BIOS PROTECTION GUIDELINES

Executive Summary

Modern computers rely on fundamental system firmware, commonly known as the system Basic

Input/Output System (BIOS), to facilitate the hardware initialization process and transition control to the

operating system. The BIOS is typically developed by both original equipment manufacturers (OEMs)

and independent BIOS vendors, and is distributed to end-users by motherboard or computer

manufacturers. Manufacturers frequently update system firmware to fix bugs, patch vulnerabilities, and

support new hardware. This document provides security guidelines for preventing the unauthorized

modification of BIOS firmware on PC client systems.

Unauthorized modification of BIOS firmware by malicious software constitutes a significant threat

because of the BIOS’s unique and privileged position within the PC architecture. A malicious BIOS

modification could be part of a sophisticated, targeted attack on an organization—either a permanent

denial of service (if the BIOS is corrupted) or a persistent malware presence (if the BIOS is implanted

with malware). The move from conventional BIOS implementations to implementations based on the

Unified Extensible Firmware Interface (UEFI) may make it easier for malware to target the BIOS in a

widespread fashion, as these BIOS implementations are based on a common specification.

This document focuses on current and future x86 and x64 desktop and laptop systems, although the

controls and procedures could potentially apply to any system design. Likewise, although the guide is

oriented toward enterprise-class platforms, the necessary technologies are expected to migrate to

consumer-grade systems over time. The security guidelines do not attempt to prevent installation of

unauthentic BIOSs through the supply chain, by physical replacement of the BIOS chip, or through secure

local update procedures.

Security guidelines are specified for four system BIOS features:

• The authenticated BIOS update mechanism, where digital signatures prevent the installation of

BIOS update images that are not authentic.

• An optional secure local update mechanism, where physical presence authorizes installation of

BIOS update images.

• Integrity protection features, to prevent unintended or malicious modification of the BIOS outside

the authenticated BIOS update process.

• Non-bypassability features, to ensure that there are no mechanisms that allow the system

processor or any other system component to bypass the authenticated update mechanism.

Additionally, management best practices which complement the security guidelines are presented. Five

distinct phases are addressed:

• The Provisioning Phase, which establishes configuration baselines identifying the approved BIOS

version and configuration settings.

• The Platform Deployment Phase, which establishes or verifies the configuration baseline using a

secure local update mechanism.

• The Operations and Maintenance Phase, where systems are monitored for unexpected changes

and planned BIOS updates are executed using the authenticated BIOS update mechanism.

• The Recovery Phase, which supports authorized rollback to an earlier BIOS version and recovery

from a corrupted BIOS.

• The Disposition Phase, where the BIOS and configuration data are restored to their original

settings to prevent against accidental information leakage.

Future revisions to this publication will also address the security of critical system firmware that interact

with the BIOS.

ES-1

剩余25页未读，继续阅读

艾米的爸爸

粉丝: 782
资源: 314

NIST SP800-147：云计算决策指南与 BIOS 保护推荐

NIST SP800-147B.pdf

信息安全测试评估技术指南NIST SP 800-115

nist 800-181标准中文版

nist sp800-161下载

NIST SP800-90A

nist sp800-181

nist sp800-108

NIST SP800-131A

nist sp800-60

2017 nist sp800-181

最新资源