It seems to me that to maximise server security, one ought - in addition to the usual security measures implemented in software - to prevent the overwriting of certain parts of the server system, such that only physical access will circumvent this write-protection.
If a remote attacker who has been successful enough to gain arbitrary code execution privileges can modify the following, then that server is significantly less secure than it would be if such an attacker could not modify them:
This is a defence in depth rationale.
My questions are as follows:
Is it possible to write-protect BIOS chips at the hardware level, e.g. with a device having a similar form-factor to a BIOS Savior but instead possessing a hardware switch that physically prevents current from reaching the circuitry capable of overwriting the BIOS? (NB: The NSA's "ANT division [has] a clear preference for planting their malicious code [in] BIOS.")
Similarly, is it possible to write-protect processors at the hardware level, e.g. with a device having a similar form-factor, mutatis mutandis, to that described above for the BIOS, i.e. sitting physically between the CPU socket on the motherboard and, the CPU itself, and again possessing a hardware switch that physically prevents current from reaching the circuitry capable of overwriting the CPU's firmware?
Operating system storage
It is already possible to write-protect the storage medium containing the operating system installation at the hardware level by utilising a read-only optical drive for that storage (e.g. CD-ROM, DVD-ROM, etc). Other options would include write-protected USB flash drives, or forensic USB write-blockers installed between the USB port and the drive containing the OS.
Even though Live CDs are often used for testing or experimentation, this does not seem to be common practice in deployment. Perhaps this is because sysadmins would prefer not to have to gain physical access to every server for every OS update, even if it would just be a matter of replacing a DVD-ROM and rebooting; but I do not share that preference: to me, security is more important.
- Are there any server OSes/distros designed to support this sort of configuration out of the box?
- Are there any information resources (books, websites) dedicated to deploying and maintaining servers in this fashion?