<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="generator" content="Osso Notes">
<title></title></head>
<body>
<p>----- Mensaje original -----
<br>> On 02/06/12 15:56, Alan Bell wrote:
<br>> > > Could linux foundation do the same for the servers? beause they can
<br>> > > be "cracked" in a similar way?
<br>> > >
<br>> >
<br>> > servers generally won't get the secure boot thing. Odd really because
<br>> > it kind of makes more sense to me in that context.
<br>> >
<br>>
<br>> Probably because the biggest market for servers is corporate customers
<br>> who have their own IT department and who would very quickly go see
<br>> another supplier if they had to fiddle with settings in order to install
<br>> the operating system of their choice on their systems. For a typical
<br>> large corporate that regularly installs dozens of servers, any change in
<br>> installation procedure means:
<br>>
<br>> * Re-train the whole of IT,
<br>> * Change all training and documentation material,
<br>> * Update the process of how business units get servers commissioned,
<br>> * Find a way to phase in the new process while phasing out the old one,
<br>> * Getting confirmation from suppliers of what exact models will have
<br>> UEFI so that they can have clear guidance: if model A, then do
<br>> process 1 else do process 2,
<br>> * Factor in additional costs and delays for the inevitable cock-ups
<br>> that will happen.
<br>>
<br>>
<br>> It's an interesting game that Microsoft are playing and I'm wondering
<br>> whether their primary motivation is to lock competition out or to force
<br>> the last refuseniks off XP and onto a more recent version of Windows.
<br>> > From an OEM perspective, what could happen is that you would see UEFI
<br>> > on
<br>> consumer ranges first, where customers tend to just go with what's
<br>> pre-installed, and then slowly see it appear on business ranges, where
<br>> customers tend to wipe the pre-installed OS and replace it with their
<br>> in-house image.
<br>>
<br>> The fact that this logic is completely at odds with the security
<br>> benefits of UEFI secure booting only makes sense if you see it from an
<br>> accounting point of view: secure boot is a technical tool to mitigate
<br>> the risk of a server getting compromised. This is modelled as a risk
<br>> with associated cost (cost of rebuilding a compromised server, checking
<br>> if it's the only compromised one, potential reputation costs, etc). Most
<br>> companies already mitigate that risk using firewalls, intrusion
<br>> detection systems, etc. Mitigation is not perfect so there is a residual
<br>> risk with associated cost. UEFI secure boot is then an opportunity to
<br>> reduce this residual cost through additional mitigation. If the cost
<br>> saving that results from migrating the estate to UEFI secure boot is
<br>> lower than the cost of actually doing it, companies will just stay put
<br>> with what they have, accept the risk and pay the price whenever the risk
<br>> is realised.
<br>>
<br>> So the fact that servers won't get the secure boot option is simply a
<br>> sign that nobody has yet managed to demonstrate that the cost of
<br>> introducing secure boot in a corporate environment was lower than the
<br>> potential cost of the risk it mitigates.
<br>>
<br>> Cheers,
<br>>
<br>> Bruno
<br>>
<br>
<br>thanks for the info guys! Got more than I need! I was a bit concernd that some servers were using arm as well. But clearly it will not be a problem. <br></p>
</body>
</html>