DHS CISA Strategy to Fix Vulnerabilities Below the OS Among Worst Offenders

### Overview In this presentation, Boyden Rohner and Tom Ruoff from the Cyber Security Division at the Cybersecurity and Infrastructure Security Agency (CISA) examine an emerging class of threats: vulnerabilities below the operating system (VBOS). Comparing software security to an iceberg, they emphasize that while the cybersecurity industry traditionally focuses on the visible tip—the operating system and application layers—critical risks lurk beneath in firmware, BIOS, and UEFI layers. As commercial threat actors increasingly repurpose sophisticated rootkits once restricted to nation-states, addressing firmware-level vulnerabilities has become an urgent priority for national critical infrastructure resilience.

### Key Topics - **Vulnerabilities Below the Operating System (VBOS):** Defining the security gap in code that connects hardware to the operating system, particularly firmware and UEFI. - **The Worst Offender Concept:** Rather than naming specific commercial vendors, the speakers identify UEFI as the "worst offender" due to its ubiquity, core architectural role, and chronic lack of enforced memory protections. - **The Nutrition Label / Twinkie Analogy:** A conceptual framework comparing software transparency to FDA food labeling: Software Bills of Materials (SBOMs) show the "ingredients," but testing reports and designer intent are essential to evaluate actual risk. - **Discrepancy Between Software Intent vs. Capability:** Formulating risk indicator scoring by evaluating whether purpose-built devices perform only their intended functions or exhibit unintended, exploitable capabilities.

### Technical Details To ground the threat, the speakers highlight real-world historical attacks exploiting VBOS: - **2015 Ukrainian Power Grid Attack:** Adversaries installed malicious firmware onto serial-to-internet gateway devices, severing remote operator access and preventing substations from being brought back online after opening circuit breakers. - **2018 LoJax Campaign:** Threat actors deployed a UEFI rootkit that compromised legitimate anti-theft software (LoJack), utilizing phishing drop vectors and command-and-control channels to maintain persistence across OS reinstallation and hard drive replacement.

Rohner and Ruoff contrast above-the-OS defenses with below-the-OS realities. While above-the-OS code heavily deploys mitigations like Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR)—approaching 90% implementation in commercial products—these mitigations are rarely applied to UEFI code. Furthermore, vendors often disable hardware and memory protections (such as NX / No-Execute) by default to save cycle time or due to perceived lack of operational necessity.

To tackle software analysis at scale without "boiling the ocean," CISA advocates starting with constrained, purpose-built devices such as programmable logic controllers (PLCs) and medical devices. Because these devices have tightly scoped expected behaviors, automated testing can compare vendor design claims against actual capabilities (e.g., whether a device designed for 5 behaviors unexpectedly exhibits 25).

### Takeaways CISA outlines several paths forward for industry, government, and procurement officials: - **Leverage Policy and Executive Orders:** Organizations should review the federal Executive Order guidance on SBOMs and participate in multi-stakeholder initiatives like NTIA/SBOM. - **Shift Procurement from "Faith-Based" to "Risk-Based":** Buyers must actively ask vendors for SBOMs, lists of known CVEs and their remediations, designer intent notes, and documentation of firmware vulnerability mitigations applied (such as NX enforcement). - **Implement Compensating Controls:** Until vendors incorporate standardized mitigations below the OS, organizations should apply systems-engineering compensating controls around vulnerable firmware and devices. - **Community Collaboration:** CISA plans to convene stakeholders across critical infrastructure sectors, collaborate with code researchers on automated capability verification, and establish data-driven risk indicators to steer procurement away from the worst offenders.