Think about where attackers begin their attack? A failure of a secure data centre from within made me consider how attackers use firmware as their starting point. Is firmware the new boundary of the data centre security perimeter?
If an attacker can exploit firmware successfully, then it provides complete and persistent access to the system. Most traditional security systems do not detect such an access point, thereby making firmware the most dangerous element within a data centre.
The following reasons are why firmware attacks are so concerning:
Instead of attacking the "lock", the attacker has more control when they attack the "door".
Why Firmware Is So Important
Firmware is below the operating system and controls how hardware operates. I used to ignore firmware at the same rate as many other teams still do. No longer do cybercriminals ignore firmware.If an attacker can exploit firmware successfully, then it provides complete and persistent access to the system. Most traditional security systems do not detect such an access point, thereby making firmware the most dangerous element within a data centre.
Why Old Security Tools Miss Firmware Attacks
Firewalls and antivirus only secure software and systems above them. We need to also be worried about the fact that many companies leave their BIOS and MGT Firmware without updating them.The following reasons are why firmware attacks are so concerning:
- After you re-install your operating system, firmware attacks continue to be a problem
- The majority of current security products do not detect firmware attacks
- Firmware attacks can take complete hardware control of an infected system
Firmware vs Software Attacks
Attacks on computer software typically follow predictable patterns, while firmware attacks tend to be stealthy. Malware operating through firmware has the ability to be active before the operating system and any security software are executed.Instead of attacking the "lock", the attacker has more control when they attack the "door".
How Data Centers Can Protect Themselves
Today's smart teams incorporate firmware into their security. The key here is to:- Follow a Secure Boot Process & use Trusted Hardware.
- Update firmware on a Regular Basis.
- Only allow access to the hardware management tools on an "As Needed" basis.
