nsacyber/Hardware-and-Firmware-Security-Guidance

Guidance for the Spectre, Meltdown, Speculative Store Bypass, Rogue System Register Read, Lazy FP State Restore, Bounds Check Bypass Store, TLBleed, and L1TF/Foreshadow vulnerabilities as well as general hardware and firmware security guidance. #nsacyber

# Hardware and Firmware Security Guidance ## Table of Contents - 1\. [About this Repository](#1-about-this-repository) - 2\. [Recommended Actions](#2-recommended-actions) - 3\. [Device Configuration Guidance](#3-device-configuration-guidance) - 3\.1\. [Procurement and Acceptance Testing](#31-procurement-and-acceptance-testing) - 3\.2\. [Firmware Configuration and Hardening](#32-firmware-configuration-and-hardening) - 3\.3\. [UEFI Secure Boot](#33-uefi-secure-boot) - 3\.4\. [Zero Trust](#34-zero-trust) - 3\.5\. [Baseboard Management Controller](#35-baseboard-management-controller) - 4\. [Boot Vulnerabilities](#4-boot-vulnerabilities) - 4\.1\. [PKFail](#41-pkfail) - 4\.2\. [Shim Shady](#41-shim-shady) - 4\.3\. [BlackLotus](#43-BlackLotus) - 4\.4\. [BootHole](#44-boothole) - 4\.5\. [BootKitty](#45-bootkitty) - 5\. [Firmware Vulnerabilities](#5-firmware-vulnerabilities) - 5\.1\. [LogoFail](#51-logofail) - 5\.2\. [Lojax](#52-lojax) - 6\. [Physical Attack Vulnerabilities](#6-physical-attack-vulnerabilities) - 6\.1\. [Bitlocker dTPM Probing](#61-bitlocker-dtpm-probing) - 7\. [Side Channel Vulnerabilities](#7-side-channel-vulnerabilities) - 7\.1\. [General Messaging](#71-general-messaging) - 7\.2\. [Historical Guidance](#72-historical-guidance) - 8\. [Device Integrity](#8-device-integrity) - 8\.1\. [TPM Use Cases](#81-tpm-use-cases) - 8\.2\. [Reference Integrity Manifest](#82-reference-integrity-manifest) - 8\.3\. [Software Bill of Materials](#83-software-bill-of-materials) - 9\. [Hardware Upgrade Guidance](#9-hardware-upgrade-guidance) - 10\. [License](#10-license) - 11\. [Contributing](#11-contributing) - 12\. [Disclaimer](#12-disclaimer) ## 1. About this Repository This repository provides content for aiding DoD administrators in verifying systems have a