NIST Readies Guide on Server Protection
Mitigating Threats to the Integrity of Fundamental System Firmware
The National Institute of Standards and Technology is seeking public comment on the a draft of its Special Publication 800-147B, BIOS Protection Guidelines for Servers.
See Also: Keeping Your Side of the Street Clean: 5 Cyber-Hygiene Facts You Wish You Knew Earlier
NIST says the guide is intended to mitigate threats to the integrity of fundamental system firmware, commonly known as the Basic Input/Output System, in server-class systems.
The guide identifies security requirements and guidelines for a secure BIOS update process, using digital signatures to authenticate updates. The intended audience for this document includes BIOS and platform vendors of server-class systems and information system security professionals who are responsible for procuring, deploying and managing servers.
SP 800-147B is the second in a series of publications on BIOS protections. NIST released the first document, SP 800-147, BIOS Protection Guidelines, in April 2011 and provides guidelines for desktop and laptop systems deployed in enterprise environments.
NIST plans to develop a new publication providing an overview of BIOS protections for IT security professionals to be released as SP-800-147 Revision 1, and will reissue the current SP 800-147 as SP 800-147A at that time.
Comments on draft NIST SP 800-147B should be submitted by Sept. 14 to 800-147comments@nist.gov.
