Page 579 - (ISC)² CISSP Certified Information Systems Security Professional Official Study Guide

With the advent of ubiquitous broadband and wireless connectivity,
modems are becoming a scarce legacy computer component. If your

organization is still using older equipment, there is a chance that a
modem is part of the hardware configuration. The presence of a
modem on a user system is often one of the greatest woes of a security
administrator. Modems allow users to create uncontrolled access
points into your network. In the worst case, if improperly configured,
they can create extremely serious security vulnerabilities that allow an
outsider to bypass all your perimeter protection mechanisms and

directly access your network resources. At best, they create an
alternate egress channel that insiders can use to funnel data outside
your organization. But keep in mind, these vulnerabilities can only be
exploited if the modem is connected to an operational telephone
landline.

You should seriously consider an outright ban on modems in your
organization’s security policy unless you truly need them for business

reasons. In those cases, security officials should know the physical and
logical locations of all modems on the network, ensure that they are
correctly configured, and make certain that appropriate protective
measures are in place to prevent their illegitimate use.

Firmware

Firmware (also known as microcode in some circles) is a term used to
describe software that is stored in a ROM chip. This type of software is
changed infrequently (actually, never, if it’s stored on a true ROM chip
as opposed to an EPROM/EEPROM) and often drives the basic
operation of a computing device. There are two types of firmware:

BIOS on a motherboard and general internal and external device
firmware.

BIOS and UEFI

The basic input/output system (BIOS) contains the operating system–
independent primitive instructions that a computer needs to start up
and load the operating system from disk. The BIOS is contained in a
firmware device that is accessed immediately by the computer at boot
time. In most computers, the BIOS is stored on an EEPROM chip to