MITRE D3FENDdefensive technique

D3-SFV System Firmware Verification

Official page ↗

Tactic: Detect

Definition

Cryptographically verifying installed system firmware integrity.

How it works

How it works Cryptographic hash values are computed for system firmware. The hash values are compared against precomputed firmware hash values to determine if the firmware has been tampered with. When system firmware verification fails a set of predefined responses is typically invoked. The responses may direct the system to disable some devices or operations. Considerations • Requires the use of system provided security modules • Secure hash values will need to be computed for firmware

Counters · MITRE ATT&CK (3)

T1542.004 ROMMONkit sub-technique
T1542.001 System Firmware sub-technique
T1542 Pre-OS Boot technique

Child of · MITRE D3FEND (1)

D3-FV Firmware Verification defensive technique

References

https://patents.google.com/patent/US20200074086A1/en Methods and systems for hardware and firmware security monitoring
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-193.pdf Platform Firmware Resiliency Guidelines