MID-057: Disable Physical Development and Debugging Ports

Mitigation Tier: Foundational

Description

Physical ports used during the device development and debugging process should be disabled or removed in devices meant for production use. This includes dedicated memory debug interfaces (e.g., JTAG), UART serial ports that expose sensitive data or command shells, or any similar port. These ports should be disabled in hardware (preferably) by engaging security fuses or at least in software. Simply depopulating physical headers on device circuit boards is not sufficient. Ideally, such ports should be disabled permanently, but if some degree of diagnostic capability is desired for production devices, reenabling one of these ports should be an authenticated administrative action.

IEC 62443 4-2 Mappings

• EDR / HDR / NDR 2.13 - Use of physical diagnostic and test interfaces 

References

[1] J. van Woudenberg. “Top 10 Secure Boot mistakes.” Presented at hardware.io Hardware Security Conference and Training, Santa Clara, CA, USA, 2019. [Online]. Available: https://hardwear.io/usa-2019/presentations/Top-10-Secure-Boot-Mistakes-v1.1-hardwear-io-usa-2019-jasper-van-woudenberg.pdf

MID-057