Overview · GitBook
System firmware, commonly referred to as Basic Input Output System (BIOS), plays an important role in platform security. Running unauthorized firmware components may introduce significant threats by creating a permanent denial of service or introducing persistent malware. In 2011, the National Institute of Standards and Technology (NIST) published BIOS Protection Guidelines (SP800-147). NIST extended the scope to all platform firmware and published Platform Firmware Resiliency Guidelines (SP800-193) in 2018. The goal of those documents is to provide a general guideline for firmware integrity. The UEFI Secure Boot chain can be applied to the Clark-Wilson integrity policy, developed in 1987. The Clark Wilson model includes the following concepts: Data Item: Constrained Data Item (CDI) Unconstrained Data Item (UDI) Procedure: Integrity Verification Procedure (IVP) Transformation Procedures (TPs) Rule: Certification Rule (CR) – integrity monitoring C1: (Basic: IVP Certification) All IVPs m