Boot Integrity

Use secure methods to boot a system and verify the integrity of the operating system and loading mechanisms.

ID: M1046
Version: 1.0
Created: 11 June 2019
Last Modified: 19 May 2020

Techniques Addressed by Mitigation

Domain ID Name Use
Enterprise T1495 Firmware Corruption

Check the integrity of the existing BIOS and device firmware to determine if it is vulnerable to modification.

Enterprise T1542 Pre-OS Boot

Use Trusted Platform Module technology and a secure or trusted boot process to prevent system integrity from being compromised. Check the integrity of the existing BIOS or EFI to determine if it is vulnerable to modification. [1] [2]

.001 System Firmware

Check the integrity of the existing BIOS or EFI to determine if it is vulnerable to modification. Use Trusted Platform Module technology. [1] Move system's root of trust to hardware to prevent tampering with the SPI flash memory.[3] Technologies such as Intel Boot Guard can assist with this. [4]

.003 Bootkit

Use Trusted Platform Module technology and a secure or trusted boot process to prevent system integrity from being compromised. [1] [2]

Enterprise T1195 .003 Supply Chain Compromise: Compromise Hardware Supply Chain

Use Trusted Platform Module technology and a secure or trusted boot process to prevent system integrity from being compromised. Check the integrity of the existing BIOS or EFI to determine if it is vulnerable to modification. [1] [2]

References