RFC 3871           Operational Security Requirements      September 2004

      fixes, new versions of code, etc.).  Without a mechanism to load

      new vendor supplied code, it may not be possible to mitigate the

      risk posed by these vulnerabilities.

   *  It is also conceivable that malicious behavior on the part of

      hackers or unintentional behaviors on the part of operators could

      cause software on devices to be corrupted or erased.  In these

      situations, it is necessary to have a means to (re)load software

      onto the device to restore correct functioning.

   *  It is important to be able to load new software while disconnected

      from all public IP networks because the device may be vulnerable

      to old attacks before the update is complete.

   *  One has to assume that hackers, operators, etc. may erase or

      corrupt all writable media (disks, flash, etc.).  In such

      situations, it is necessary to be able to recover starting with

      only non writable media (e.g., CD ROM, a true ROM based monitor).

   *  System images may be corrupted in transit (from vendor to

      customer, or during the loading process) or in storage (bit rot,

      defective media, etc.).  Failure to reliably load a new image, for

      example after a hacker deletes or corrupts the installed image,

      could result in extended loss of availability.

   Examples.

      The device could support booting into a simple ROM based monitor

      that supported a set of commands sufficient to load new operating

      system code and configuration data from other devices.  The

      operating system and configuration might be loaded from:

   RS232. The device could support uploading new code via an RS232

      console port.

   CD ROM. The device could support installing new code from a

      locally attached CD ROM drive.

   NETWORK. The device could support installing new code via a

      network interface, assuming that (a) it is disconnected from all

      public networks and (b) the device can boot an OS and IP stack

      from some read only media with sufficient capabilities to load new

      code  from the network.

Jones                        Informational                     [Page 26]