Platform Firmware Resiliency Guidelines - DRAFT NIST SP 800-193: Resiliency of Platform Firmware Against Destructive Attacks

DRAFT NIST SP 800-193 Released May 2017

Printed in COLOR

This document provides technical guidelines and recommendations supporting resiliency of platform firmware and data against potentially destructive attacks. The platform is a collection of fundamental hardware and firmware components needed to boot and operate a system. A successful attack on platform firmware could render a system inoperable, perhaps permanently or requiring reprogramming by the original manufacturer, resulting in significant disruptions to users. The technical guidelines in this document promote resiliency in the platform by describing security mechanisms for protecting the platform against unauthorized changes, detecting unauthorized changes that occur, and recovery from attacks rapidly and securely. Implementers, including Original Equipment Manufacturers (OEMs) and component/device suppliers, can use these guidelines to build stronger security mechanisms into platforms. System administrators, security professionals, and users can use this document to guide procurement strategies and priorities for future systems.

Why buy a book you can download for free?

First you gotta find it and make sure it’s the latest version, not always easy. Then you gotta print it using a network printer you share with 100 other people – and its outta paper – and the toner is low (take out the toner cartridge, shake it, then put it back). If it’s just 10 pages, no problem, but if it’s a 250-page book, you will need to punch 3 holes in all those pages and put it in a 3-ring binder. Takes at least an hour. An engineer that’s paid $75 an hour has to do this himself (who has assistant’s anymore?).

If you are paid more than $10 an hour and use an ink jet printer, buying this book will save you money.

It’s much more cost-effective to just order the latest version from Amazon.com

This book includes copyrighted material published by 4th Watch Books. We publish tightly-bound, full-size books at 8 ½ by 11 inches, with glossy covers. 4th Watch Books is a Service Disabled Veteran Owned Small Business (SDVOSB) and is not affiliated with the National Institute of Standards and Technology.

For more titles published by 4th Watch, please visit: cybah.webplus.net

A full copy of all the pertinent cybersecurity standards is available on DVD-ROM in the CyberSecurity Standards Library disc which is available at Amazon.com.

GSA Courtroom Technology Manual

NIST SP 500-299 NIST Cloud Computing Security Reference Architecture

NIST SP 500-291 NIST Cloud Computing Standards Roadmap Version 2

NIST SP 500-293 US Government Cloud Computing Technology Roadmap Volume 1 & 2

NIST SP 500-293 US Government Cloud Computing Technology Roadmap Volume 3 DRAFT

NIST SP 1800-8 Securing Wireless Infusion Pumps

NISTIR 7497 Security Architecture Design Process for Health Information Exchanges (HIEs)

NIST SP 800-66 Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule

NIST SP 1800-1 Securing Electronic Health Records on Mobile Devices

NIST SP 800-177 Trustworthy Email

NIST SP 800-184 Guide for Cybersecurity Event Recovery

NIST SP 800-190 Application Container Security Guide

NIST SP 800-193 Platform Firmware Resiliency Guidelines

NIST SP 1800-1 Securing Electronic Health Records on Mobile Devices

NIST SP 1800-2 Identity and Access Management for Electric Utilities

NIST SP 1800-6 Domain Name Systems-Based Electronic Mail Security

NIST SP 1800-7 Situational Awareness for Electric

NIST SP 500-293

NIST SP 500-293

NIST SP 800-184