When most companies put an update strategy into place, they’re concerned about operating system and software updates. These are the ones that will pop up and give you some type of notification that there’s an update that needs to be installed.
But there’s another type of device update that isn’t so visible. If there’s any notification at all it’s usually something small, like an exclamation point on a tiny system icon. Firmware updates are often misunderstood and ignored by many businesses.
There is one group that has put firmware front and center. Hackers are taking advantage of the fact that firmware updates are largely neglected by a large percentage of businesses. They are increasingly targeting firmware for device takeovers.
Over the last four years, the volume of firmware attacks has increased five-fold, according to the National Institute of Standards and Technology (NIST).
According to the 2020 Security Signals Report, 83% of all businesses have experienced a firmware attack within the last two years, and most are largely unprotected.
Firmware is a type of software, but it’s software that is tied to hardware and has one purpose. This purpose is to tell a device how to operate.
Devices like computers, IP security cameras, and even the remote control for your television can’t operate without firmware telling it what to do.
Firmware typically will not receive as many updates as software or operating systems because it’s largely on the unseen backend of device administration. So, firmware updates will usually only be done when a critical security patch is needed or for a compatibility update for a newer system function.
Why have hackers increased attacks on firmware? Some of the reasons include:
Hackers will typically continue probing a network for any vulnerabilities they can find. They’re always looking for the path of least resistance, and in the case of firmware, many have found it.
As companies have upgraded their cybersecurity, cutting off ways for cybercriminals to break into a network, they’ve sought out other avenues. Firmware has so far proven to be a lucrative path to a network breach.
The rise in firmware attacks means that updating and protecting firmware needs to be one of your cybersecurity priorities in 2021.
There are several ways you can protect your firmware, and thus your devices, from being breached.
You should include firmware updates on a schedule, along with other system updates for operating systems and software. Since these updates don’t typically pop up the same type of visual reminders as other updates, it’s important to be proactive.
Subscribing to a managed IT services plan can help ensure that firmware updates are done regularly, just as other types of updates are done.
Firmware updates aren’t only needed for computers and servers. Any type of technology hardware will have firmware running it and need to be checked for updates regularly.
This includes equipment, such as:
Microsoft recently announced that it was launching advanced hardware security to better protect against firmware attacks. This technology is called Secured-core.
This technology is available on new PCs and Servers, and it uses a layered architecture with built-in security to protect against firmware compromise. It uses a zero-trust model, offering security features such as:
One of the main attack methods used to infiltrate firmware is phishing. An employee opens the wrong file from an email, and suddenly attack code is executed and searching for any firmware vulnerabilities.
It’s important to keep employees fully trained and up to date on the latest phishing scams. This means keeping training ongoing as a part of your cybersecurity strategy, not just conducting training once a year.
Your employees are one of your most important cybersecurity layers due to phishing being the main cause of data breaches of all shapes and sizes.
Haxxess can help your Northern Ontario company avoid becoming the victim of a firmware attack and device takeover. Our managed IT services give you trouble-free protection.
Contact us today to schedule a free consultation! Call 705-222-8324 or reach out online.