Systems and methods for aggregated vulnerability proofing of an IHS
Systems and methods are provided for vulnerability proofing the administration of hardware components of an IHS. A proposed configuration for a hardware component of the IHS is detected. Multiple catalogs specifying known vulnerabilities of hardware components are accessed, such as a catalog of known vulnerabilities provided by a manufacturer of the hardware component and such as a catalog of known vulnerabilities provided by a manufacturer of the IHS. The proposed configuration of the hardware component is evaluated as being vulnerable in the first catalog and also in the second catalog. If the proposed configuration is identified as vulnerable in either the first catalog or in the second catalog, the hardware component is disabled until the proposed configurations for the hardware component are changed to include no configurations with vulnerabilities identified in either the first or second catalogs.
1. An IHS (Information Handling System) comprising:
one or more CPUs utilizing one or more buses that connect to a plurality of hardware components of the IHS; and
a remote access controller supporting remote management of the Information Handling System (IHS), the remote access controller comprising a logic unit and a memory device having instructions stored thereon that, upon execution by the logic unit, cause the remote access controller to:
detect a proposed configuration of a first of the hardware components of the IHS,
access two or more catalogs specifying known vulnerabilities of hardware components, wherein a first of the catalogs comprises known vulnerabilities provided by a manufacturer of the first hardware component, wherein a second of the catalogs comprises known vulnerabilities provided by a manufacturer of the IHS;
determine whether the proposed configuration of the first hardware component is identified as vulnerable in the first catalog;
determine whether the proposed configuration of the first hardware component is identified as vulnerable in the second catalog; and
disable the first hardware component until the proposed configurations for the first hardware component are changed to include no configurations with vulnerabilities identified in the first catalog or in the second catalog.
2. The IHS of claim 1 , wherein the proposed configuration further comprises a configuration of a second of the hardware components of the IHS and further comprises a configuration of a workload using the first hardware component and the second hardware component.
3. The IHS of claim 2 , wherein execution of the instructions further causes the remote access controller to determine whether the proposed configuration of the second hardware component is identified as vulnerable in a third catalog provided by a manufacture of the second hardware component.
4. The IHS of claim 3 , wherein execution of the instructions further causes the remote access controller to halt the workload using the first hardware component and the second hardware component until the proposed configurations for the second hardware component are changed to include no configurations with vulnerabilities identified in the third catalog and until the proposed configurations for the first hardware component are changed to include no configurations with vulnerabilities identified in the first catalog or in the second catalog.
5. The IHS of claim 1 , wherein execution of the instructions further causes the remote access controller to identify one or more vulnerability proofing requirements for the IHS within a factory provisioned identity certificate of the IHS.
6. The IHS of claim 5 , wherein the factory-provisioned identity certificate is cryptographically bound to the remote access controller of the IHS.
7. The IHS of claim 5 , wherein the factory-provisioned identity certificate comprises digital signatures for authenticating instructions used by the first hardware component.
8. The IHS of claim 5 , wherein the validation proofing requirements in the inventory certificate further specify the first catalog and the second catalog of known vulnerabilities for use in identifying configurations of the first hardware component that are vulnerable.
9. The IHS of claim 1 , wherein the proposed configurations of the first hardware component comprise configurations for using specific versions of firmware in operation of the first hardware component.
10. The IHS of claim 9 , wherein the vulnerability catalogs specify alternate firmware versions that are not associated with known vulnerabilities.
11. A method for vulnerability proofing the administration of hardware components of an IHS (Information Handling System), wherein the vulnerability proofing is implemented by a remote access controller of the IHS that provides remote management of the IHS, the method comprising:
detecting a proposed configuration of a first of the hardware components of the IHS;
accessing two or more catalogs specifying known vulnerabilities of hardware components, wherein a first of the catalogs comprises known vulnerabilities provided by a manufacturer of the first hardware component, wherein a second of the catalogs comprises known vulnerabilities provided by a manufacturer of the IHS;
determining whether the proposed configuration of the first hardware component is identified as vulnerable in the first catalog;
determining whether the proposed configuration of the first hardware component is identified as vulnerable in the second catalog; and
disable the first hardware component until the proposed configurations for the first hardware component are changed to include no configurations with vulnerabilities identified in the first catalog or in the second catalog.
12. The method of claim 11 , wherein the proposed configuration further comprises a configuration of a second of the hardware components of the IHS and further comprises a configuration of a workload using the first hardware component and the second hardware component.
13. The method of claim 12 , further comprising determining whether the proposed configuration of the second hardware component is identified as vulnerable in a third catalog provided by a manufacture of the second hardware component.
14. The method of claim 13 , further comprising halting the workload using the first hardware component and the second hardware component until the proposed configurations for the second hardware component are changed to include no configurations with vulnerabilities identified in the third catalog.
15. The method of claim 11 , further comprising identifying one or more vulnerability proofing requirements for the IHS within a factory provisioned identity certificate of the IHS.
16. A remote access controller supporting remote management of an Information Handling System (IHS), the remote access controller comprising a memory device having instructions stored thereon that, upon execution by a logic unit, cause the remote access controller to:
detect a proposed configuration of a first of the hardware components of the IHS;
access two or more catalogs specifying known vulnerabilities of hardware components, wherein a first of the catalogs comprises known vulnerabilities provided by a manufacturer of the first hardware component, wherein a second of the catalogs comprises known vulnerabilities provided by a manufacturer of the IHS;
determine whether the proposed configuration of the first hardware component is identified as vulnerable in the first catalog;
determine whether the proposed configuration of the first hardware component is identified as vulnerable in the second catalog; and
disable the first hardware component until the proposed configurations for the first hardware component are changed to include no configurations with vulnerabilities identified in the first catalog or in the second catalog.
17. The remote access controller of claim 16 , wherein the proposed configuration further comprises a configuration of a second of the hardware components of the IHS and further comprises a configuration of a workload using the first hardware component and the second hardware component.
18. The remote access controller of claim 17 , determine whether the proposed configuration of the second hardware component is identified as vulnerable in a third catalog provided by a manufacture of the second hardware component.
19. The remote access controller of claim 18 , wherein execution of the instructions further causes the remote access controller to:
halt the workload using the first hardware component and the second hardware component until the proposed configurations for the second hardware component are changed to include no configurations with vulnerabilities identified in the third catalog.
20. The remote access controller of claim 16 , wherein execution of the instructions further causes the remote access controller to:
identify one or more vulnerability proofing requirements for the IHS within a factory provisioned identity certificate of the IHS.