Firmware_Security_and_CJIS_Compliance.pdf
PDF 396 KB Posted
- Solicitation number
- IFB- 25 - 082
- Issued by
- Pinellas County, Florida
About this file
This document is a solution brief from Eclypsium addressing firmware security and CJIS (Criminal Justice Information Services) compliance, specifically targeting government agencies and law enforcement organizations. The brief outlines Eclypsium's supply chain security platform designed to help organizations meet new firmware security requirements in the CJIS Security Policy version 5.9.2, which mandates scanning for firmware vulnerabilities and monitoring firmware integrity. The solution enables organizations to inventory and verify every component of network assets, detect tampering and compromises, and simplify firmware update rollouts.
The document highlights that Eclypsium's platform provides unique capabilities beyond traditional vulnerability scanners, including scanning often-overlooked firmware categories like Intel ME/AMT and NIC firmware, performing firmware analysis to detect changes, and assisting with firmware updates. The solution is particularly relevant for the City of St. Petersburg's Police Department, which seeks to satisfy CJIS requirement 5.9.2 SI-7 for Software, Firmware, and Information Integrity Control. Eclypsium's platform can be delivered as a SaaS or on-premises deployment, offering comprehensive security monitoring that can detect unauthorized changes, send vulnerability alerts to security tools, and help organizations quickly remediate firmware flaws.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Eclypsium_Smart_Compliance_Active_Firmware_Scanning_Software_(Addendum_#1_Revision).pdf | ||
| Base_Agreement.pdf | ||
| Eclypsium_CJIS_Preso.pptx | PPTX presentation |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
FIRMWARE SECURITY
& CJIS COMPLIANCE
Simplify CJIS compliance and secure your infrastructure supply chain
SOLUTIONS_
CJIS SECURITY POLICY_
The Criminal Justice Information Services (CJIS) is the largest division of the US Federal Bureau of
Investigation (FBI) and a centralized source of criminal justice information (CJI) for state, local, and federal law enforcement and criminal justice agencies and authorized third parties. To ensure the protection of
CJI, including fingerprint records, criminal histories, and other pertinent sensitive data, the FBI created the CJIS Security Policy document—a set of guidelines and regulations agencies utilizing CJI and the vendors that work with them must adhere to in order to meet the security requirements of handling protected information.
The latest CJIS Security Policy adds new firmware security requirements that could put significant burdens on government agencies and authorized third parties without the right solution. The Eclypsium supply chain security platform can simplify your organization’s compliance with the new CJIS controls as well as fill a critical gap in your infrastructure security.
SUPPLY CHAIN SECURITY FOR
INFRASTRUCTURE_
Some of the most devastating cyber attacks come through the supply chain. Eclypsium helps you to establish trust in the supply chain for your infrastructure—endpoints, servers, network appliances, and other devices that your organization relies on. Delivered as SaaS or through an on-premises deployment, the Eclypsium supply chain security platform makes it easy to inventory and verify every component of every asset on your network. For each device, you can monitor the integrity of software, firmware, and hardware components. You can detect tampering and compromises, and simplify the rollout of updates.
HOW ECLYPSIUM HELPS WITH CJIS CONTROLS
FLAW REMEDIATION
Identify and fix firmware vulnerabilities
SYSTEM MONITORING
Send firmware vulnerability and change alerts to SIEM or other
SOC tools
INTEGRITY VERIFICATION
Detect unauthorized changes to firmware info@eclypsium.com eclypsium.com
©2023 Eclypsium, Inc
FIRMWARE SECURITY & CJIS COMPLIANCE | 2
FIRMWARE SECURITY IS CRITICAL_
Firmware is the software embedded in hardware devices, including laptops, servers, routers, and storage devices, that controls how they operate. Attackers use tools that target firmware vulnerabilities, such as the Black Lotus bootkit, to install ransomware and steal sensitive data, such as criminal justice information.
VULNERABILITY SCANNING_
This is why CJIS Security Policy version 5.9.2 adds control requirements for scanning for firmware vulnerabilities.
Specifically, organizations are required to update firmware in as few as 15 days after an update. Eclypsium makes implementing this control easy, with ongoing scans for laptops, servers, and infrastructure devices and assistance in rolling out firmware updates.
Unlike traditional network vulnerability scanners, Eclypsium scans firmware categories that are often overlooked such as Intel ME/AMT and NIC firmware that often contain remote-exploitable vulnerabilities, performs firmware analysis to alert on changes, and even assists in rolling out firmware updates.
FIRMWARE INTEGRITY MONITORING_
CJIS Security Policy also now requires that organizations monitor the integrity of their firmware. Eclypsium extracts firmware and analyzes it against known-good firmware to detect potentially compromised systems. Vulnerability scanners and EDR tools do not offer this level of analysis.
Eclypsium is also the solution for the cross-vendor platform integrity validation system required by NIST in SP 1800-34, which demonstrates how organizations can verify that the internal components of computing devices are genuine and have not been tampered with.
Eclypsium Vulnerability Scanners EDR
Threat detection for firmware
Detects any type of malicious activity
None Limited to analysis of known-bad binaries
Firmware integrity monitoring
Detects any change by extracting and analyzing binaries
Basic (Maps versions to vulnerabilities)
None
Supply chain security Verifies software, firmware, and hardware components
None None
ABOUT ECLYPSIUM_
Eclypsium’s cloud-based platform provides digital supply chain security for critical software, firmware and hardware in enterprise infrastructure. Eclypsium helps enterprises and government agencies mitigate risks to their infrastructure from complex technology supply chains. For more information, visit eclypsium.com.
mailto:info%40eclypsium.com?subject= https://eclypsium.com/ https://eclypsium.com
File details come from the government source that posted it. Updated .