IHS Update Vulnerability Proofing via Configuration Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Information Handling Systems (IHSs) face vulnerabilities due to inconsistent and unaware configuration changes, leading to security and functional issues, as administrators may inadvertently introduce known vulnerabilities during updates, especially when relying on existing update packages without proper vulnerability checks.
Innovation Solution
An update system that queries IHSs for vulnerability proofing requirements, checks updated configurations against catalogs of known vulnerabilities, and terminates updates if vulnerabilities are detected, ensuring only secure configurations are applied, utilizing a remote access controller to manage and enforce validation proofing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If administrators apply update packages to IHSs without vulnerability checks, then update speed and productivity are improved, but security and reliability deteriorate due to introduction of known vulnerabilities
Solution Approach 1:
The system performs vulnerability checks against known vulnerability catalogs before applying updates to IHSs. The update system queries the IHS for vulnerability proofing requirements, checks the updated configurations against catalogs of known vulnerabilities, and only applies the update if no vulnerabilities are detected. This preliminary validation prevents security issues before they occur.
Solution Approach 2:
The system implements a feedback mechanism where the IHS provides vulnerability proofing requirements and the update system responds with validation results. The update system queries the IHS for vulnerability proofing requirements, checks configurations against vulnerability catalogs, and terminates the update if vulnerabilities are detected, notifying the IHS of the terminated update. This closed-loop feedback ensures security while maintaining update efficiency.
2Reliability
If administrators manually verify each configuration update for vulnerabilities, then security is improved, but administrative complexity and time consumption increase
Solution Approach 1:
The IHS automatically provides vulnerability proofing requirements when queried by the update system, and the update system automatically checks configurations against vulnerability catalogs without requiring manual administrator intervention. The system self-manages the vulnerability verification process, reducing administrative burden while maintaining security.
Solution Approach 2:
The update system performs multiple functions: it manages update packages, queries vulnerability proofing requirements, checks configurations against vulnerability catalogs, and controls update application. This multi-functional approach consolidates security verification into the existing update management infrastructure, avoiding additional complexity.
3Reliability
If vulnerability checks are performed on all update configurations, then reliability is improved, but processing time and update speed decrease
Solution Approach 1:
The system performs vulnerability checks selectively based on vulnerability proofing requirements provided by the IHS. The update system queries the IHS for vulnerability proofing requirements and checks only those specific configurations against the vulnerability catalogs, rather than performing exhaustive checks on all possible configurations. This partial action approach maintains security while reducing unnecessary processing time.
Data Source
AI summary
Systems and methods are provided for vulnerability proofing updates to an IHS (Information Handling System). An update system receives a notification of an update including updated configurations for hardware components of the IHS. The update system queries the IHS for vulnerability proofing requirements for updates that modify configurations of hardware components of the IHS. In response to the query, vulnerability proofing requirements are retrieved from a persistent data storage of the IHS and transmitted to the update system, where the vulnerability proofing requirements specify catalogs of known vulnerabilities of hardware components. The update system determines whether the updated configurations are identified as vulnerable in the one or more of catalogs. If the updated configurations are not identified in the catalogs, the update is transmitted to the IHS. If configurations from the update are identified in the catalogs, the update is terminated and the IHS is notified.