HP Sure Start

18
Technical white paper | HP Sure Start
NIST SP 800-193 HP Sure Start
Detection of
Corrupted Critical
Data (Section 4.3.2)
Meets all
Resiliency
Requirements
A successful attack on the Active Critical Data will not impact Gen3+’s RTD. The RTD
is maintained in a private ash area inaccessible to the system software that might
compromise Active Critical Data.
Gen3+ can save and validate critical data through use of digest hashes prior to using that
critical data, and Gen3+ can initiate a recovery of the critical data if corruption is detected.
Recovery of
Mutable Code
(Section 4.4.1)
Meets all
Resiliency
Requirements
Gen3+’s ESC implements the recovery capability.
A successful attack on the platform rmware will not impact Gen3+’s RTRec. The RTRec
is maintained in a private ash area inaccessible to the system software that might
compromise the platform rmware.
Gen3+’s RTRec has access to a locally stored copy of the platform’s UEFI image in its
private ash area, which is inaccessible to (protected from) system software.
Gen3+ can update the locally stored authentic UEFI image in its private ash area through
an Authenticated Update mechanism.
Recovery of Critical
Data (Section 4.4.2)
Meets all
Resiliency
Requirements
Gen3+’s ESC implements the recovery capability.
A successful attack on Active Critical Data will not impact Gen3+’s RTRec. The RTRec
is maintained in a private ash area inaccessible to the system software that might
compromise Active Critical Data.
Gen3+ can recover critical data back to factory defaults including per-platform-specic
data that is backed up in isolated & protected storage.
Gen3+ can recover non-per-platform-specic defaults from the backup BIOS image
stored in isolated and protected storage.
Gen3+ does not use policies included as part of Critical Data to restore critical data.
Logging and
notication
Exceeds all
Resiliency
Requirements
Gen3+ will notify user of corruption and log the event.
Gen3+’s detection mechanism is capable of logging events when corruption is detected.
Gen3+ will notify user of a recovery event and log the event.
Gen3+’s detection mechanism is capable of logging events when a recovery action has
taken place.
Policy-based
controls
Exceeds all
Resiliency
Requirements
Gen3+’s detection mechanism has policies which control the action taken by the Runtime
Detection.
Automatic or
manual recovery
options
Exceeds all
Resiliency
Requirements
Gen3+ Runtime Detection can initiate a recovery process automatically or after
notication of detection corruptions to the user.
Gen3+ can automatically perform its recovery operations without user interaction or it
may require user approval, dependent on policy setting.
Gen3+ gains approval from the user before replacing the current Critical Data, based on
recovery policy setting.
Gen3+ can recover Critical Data back to a last-known good state.
Gen3+ gains approval from the user before replacing the current Critical Data, based on
recovery policy setting.
Local or remote
recovery
Exceeds all
Resiliency
Requirements
Gen3+ can automatically perform its recovery operations without user interaction or it
may require user approval, dependent on policy setting.