Pre-operating system embedded controller hardening based on operating system security awareness
An information handling system includes an embedded controller and a memory device storing code that when executed causes the embedded controller to perform operations that includes receiving a request to change a security setting, determining a security policy associated with the security setting, and determining whether the change to the security setting deviates from the security policy. In addition, the embedded controller in response to determining that the change to the security setting deviates from the security policy, denying the request and reverting the change to the security setting.
1. A method comprising:
receiving, by an embedded controller, a request to change a security setting;
determining a security policy associated with the security setting;
determining whether the request to change to the security setting adheres to the security policy; and
in response to determining that the request to change to the security setting is authorized but the change to the security setting does not adhere with the security policy, denying the request and overwriting the change to the security setting with a previous value using a secured memory-mapped input/output command.
2. The method of claim 1 , further comprising in response to determining that the change to the security setting adheres to the security policy, authorizing the request and applying the change to the security setting.
3. The method of claim 1 , wherein the security setting is an operating system level security setting.
4. The method of claim 1 , wherein the security setting is a system basic input-output system (BIOS) security setting.
5. The method of claim 1 , further comprising restricting access to a locked controller device.
6. The method of claim 1 , wherein the embedded controller is provisioned with the security policy.
7. The method of claim 1 , further comprising logging the request to change the security setting.
8. The method of claim 1 , wherein the embedded controller is communicatively coupled to a software service via a secured memory-mapped input/output bus.
9. An information handling system, comprising:
an embedded controller; and
a memory device storing code that when executed causes the embedded controller to perform operations, the operations including:
receiving, by the embedded controller, a write operation request to change an operating system level security setting;
determining a security policy associated with the operating system level security setting;
determining whether the change to the operating system level security setting deviates from the security policy; and
in response to determining that the write operation request to change to the operating system level security setting deviates from the security policy, denying the write operation request and overwriting the change to the operating system level security setting with a previous value.
10. The information handling system of claim 9 , the operations further comprising in response to determining that the change to the operating system level security setting adheres to the security policy, authorizing the write operation request and applying the change to the operating system level security setting.
11. The information handling system of claim 9 , wherein the operating system level security setting is an operating system security setting.
12. The information handling system of claim 9 , wherein the operating system level security setting is an information technology decision maker (ITDM) security setting.
13. The information handling system of claim 9 , wherein the security policy is a corporate policy.
14. The information handling system of claim 9 , wherein the embedded controller is provisioned with the security policy.
15. The information handling system of claim 9 , wherein the embedded controller is communicatively coupled to a software service via a secured memory-mapped input/output.
16. A non-transitory computer-readable media to store instructions that are executable to perform operations, the operations comprising:
receiving, by an embedded controller, a write operation request to change a pre-operating system level security setting;
determining a security policy associated with the write operation request to change the pre-operating system level security setting; and
if the write operation request to change to the pre-operating system level security setting is unauthorized, then restricting access to the pre-operating system level security setting based on the security policy.
17. The non-transitory computer-readable media of claim 16 , wherein the operations further comprise if the change to the pre-operating system level security setting adheres to the security policy, then authorizing the write operation request, and applying the change to the pre-operating system level security setting.
18. The non-transitory computer-readable media of claim 16 , wherein the pre-operating system level security setting is basic input/output system (BIOS) security setting.
19. The non-transitory computer-readable media of claim 16 , wherein the restricting access to the pre-operating system level security setting includes greying out the pre-operating system level security setting.
20. The non-transitory computer-readable media of claim 16 , wherein the pre-operating system level security setting is a hardware security setting.