DHS CISA Strategy to Fix Vulnerabilities Below the OS Among Worst Offenders
summary
CISA declares a national effort to remediate vulnerabilities below the OS, naming UEFI as worst offender after citing the 2015 Ukrainian grid compromise (malicious firmware on serial‑to‑IP gateways) and the 2018 LoJax UEFI rootkit; analysis shows rising VBOS incidents and that common mitigations (DEP/ASLR) don’t apply below the OS. Plan centers on SBOMs plus designer notes, automated capability testing and a risk indicator/scoring for constrained devices (PLCs, medical), and urges require SBOM in procurements.
AI-written summary · about
chapters (11)
- 0:00Start
- 1:32The Software Illusion
- 5:55VBOS Taxonomy of Computer Icebergs - Incidents
- 7:13A Growing Problem
- 10:56BAD NEWS. There are no ways to apply vulnerability Mitigations below the OS
- 13:01UEFI - The Worst Offenders
- 14:00VBOS-Twinkie Analogy
- 16:58What CISA Thinks Success Looks Like
- 23:46Making a Risk Based Decision
- 25:17CISA: Putting Security into Practice
- 26:14How to Get Involved
related talks
33mUnderstanding the Impact of Critical Vulnerabilities in Critical Infrastructure: A De...
30mPractical Attack Vectors and Their Ideal Defensive Strategies for ICS & SCADA
50mSoftware Supply Chain: Panel on Threat Intel, Trends, Mitigation Strategies
22mSemi-Advanced Threats vs the Semi-Critical Infrastructure
37mThe Firmware Supply-Chain Security Is Broken: Can We Fix It?
29mSponsored Session: Who Will Move Your Cheese ? IEC, CRA, Cyber Security
58mAttacking through the Software Supply Chain
57mDon’t Forget the Little Guy: Vulnerability Management in Operational Technology