# What is Firmware Security?

> Firmware security is the protection of low-level software embedded in hardware components or devices across its design, production, delivery, installation, operation, update, recovery, and retirement.

- Canonical URL: https://yellowcube.eu/glossary/firmware-security/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

Firmware often initializes hardware or provides privileged services below the operating system, so compromise or corruption can enable unauthorized control, falsify higher-layer observations, expose data, disrupt operation, or make a device difficult to recover.

The practice joins product engineering, supply-chain assurance, platform protection, asset and version inventory, authenticated updates, vulnerability handling, monitoring, and resilient recovery. Responsibilities may span chip, component, device, software, and service suppliers as well as the operator.

### Key points

- **Build and supply chain:** Protect source, build systems, signing keys, images, manifests, programming facilities, supplier inputs, and provenance; verify that the correct firmware reaches the intended hardware.
- **Device protection:** Restrict unauthorized writes, validate code before execution where supported, isolate privileged functions, protect security-critical configuration, and detect unauthorized change using trustworthy mechanisms.
- **Maintenance and resilience:** Inventory versions, provide authenticated updates, prevent unauthorized rollback, remediate vulnerabilities, define support periods, and maintain tested recovery from interrupted or malicious updates.
- **Important limitation:** A valid signature or successful secure-boot check establishes authorization under a key and policy, not that firmware is free of defects or compromise before signing. Some devices also lack safe remote recovery, so changes must account for availability and physical-service requirements.

### Related terms

[Secure boot](<https://yellowcube.eu/glossary/secure-boot/>) · [Rootkit](<https://yellowcube.eu/glossary/rootkit/>) · [Vulnerability management](<https://yellowcube.eu/glossary/vulnerability-management/>) · [Supply-chain security](<https://yellowcube.eu/glossary/supply-chain-security/>) · [Internet of Things (IoT)](<https://yellowcube.eu/glossary/internet-of-things/>)

### Sources

[NIST SP 800-193: Platform Firmware Resiliency Guidelines](https://csrc.nist.gov/pubs/sp/800/193/final) · [NIST SP 800-147: BIOS Protection Guidelines](https://csrc.nist.gov/pubs/sp/800/147/final) · [RFC 9124: A Manifest Information Model for Firmware Updates in IoT Devices](https://www.rfc-editor.org/rfc/rfc9124.html)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.