Abstract: A system and method for remediating and redeploying out of compliance applications and cloud services uses integrated vulnerability information. The system and method may use Conda packages and compliance reports to perform the monitoring, remediation and redeployment.

Abstract: A firmware update system is described that collectively handles secure firmware updates for hardware resources in a defined and consistent manner. The firmware update system may be configured to manage at least some firmware updates in a pre-boot environment (e.g., before an operating system is loaded). By doing so, the firmware update system exercises control over the updates and reduce entry points exposed to attackers. In one approach, update states are defined for hardware resources that are managed by the firmware update system. In a pre-boot environment, the update states for the managed hardware resources are set to enable firmware updates. The firmware update system may then detect and apply firmware updates available for the managed hardware resources. Update states may be set to disable before loading the operating so that firmware updates for managed resources are disabled outside of the secure pre-boot environment.

Abstract: A firmware update system is described that collectively handles secure firmware updates for hardware resources in a defined and consistent manner. The firmware update system may be configured to manage at least some firmware updates in a pre-boot environment (e.g., before an operating system is loaded). By doing so, the firmware update system exercises control over the updates and reduce entry points exposed to attackers. In one approach, update states are defined for hardware resources that are managed by the firmware update system. In a pre-boot environment, the update states for the managed hardware resources are set to enable firmware updates. The firmware update system may then detect and apply firmware updates available for the managed hardware resources. Update states may be set to disable before loading the operating so that firmware updates for managed resources are disabled outside of the secure pre-boot environment.

Abstract: A firmware update system is described that collectively handles secure firmware updates for hardware resources in a defined and consistent manner. The firmware update system may be configured to manage at least some firmware updates in a pre-boot environment (e.g., before an operating system is loaded). By doing so, the firmware update system exercises control over the updates and reduce entry points exposed to attackers. In one approach, update states are defined for hardware resources that are managed by the firmware update system. In a pre-boot environment, the update states for the managed hardware resources are set to enable firmware updates. The firmware update system may then detect and apply firmware updates available for the managed hardware resources. Update states may be set to disable before loading the operating so that firmware updates for managed resources are disabled outside of the secure pre-boot environment.

Abstract: A firmware update system is described that collectively handles secure firmware updates for hardware resources in a defined and consistent manner. The firmware update system may be configured to manage at least some firmware updates in a pre-boot environment (e.g., before an operating system is loaded). By doing so, the firmware update system exercises control over the updates and reduce entry points exposed to attackers. In one approach, update states are defined for hardware resources that are managed by the firmware update system. In a pre-boot environment, the update states for the managed hardware resources are set to enable firmware updates. The firmware update system may then detect and apply firmware updates available for the managed hardware resources. Update states may be set to disable before loading the operating so that firmware updates for managed resources are disabled outside of the secure pre-boot environment.

Abstract: In response to entering a secure mode a processor disables access to first predetermined processor information through a sideband interface, while maintaining access to second predetermined processor information through the sideband interface. In the processor, a first interface portion of the sideband interface may provide access to the first predetermined processor information and a second interface portion of the sideband interface may provide access to the second predetermined processor information. The first interface portion is enabled in response to a power-on sequence and is selectably enabled under software control after being disabled on entering the secure mode. The second and additional interface portions may provide access to information related to processor temperature, power management, or machine checks.

Abstract: A management controller supplies a processor with a command via a sideband interface on the processor. Responsive to the command, the processor reads storage locations accessible by the processor and supplies the contents of the storage locations to the management controller via the sideband interface. The management controller then evaluates the integrity of software associated with the storage locations by comparing a digital signature associated with the software to a known digital signature.

Abstract: In response to entering a secure mode a processor disables access to first predetermined processor information through a sideband interface, while maintaining access to second predetermined processor information through the sideband interface. In the processor, a first interface portion of the sideband interface may provide access to the first predetermined processor information and a second interface portion of the sideband interface may provide access to the second predetermined processor information. The first interface portion is enabled in response to a power-on sequence and is selectably enabled under software control after being disabled on entering the secure mode. The second and additional interface portions may provides access to information related to processor temperature, power management, or machine checks.