EFS Network Management encourages administrators to check firmware updates for various devices. Most all computer based devices today have some type of firmware. This firmware should be reviewed for known security issues and known stability issues.

Types of devices that have firmware are printers, copiers, desktops, notebooks, handheld devices, credit card machines, fax machines, alarm systems, phone systems, video systems, key fob systems, smartphones, hard drives, servers, controller cards, firewall devices, wireless devices, scanners, network switches, USB drives, barcode scanners, mice, security devices and more.

These are vectors of attack and exploitation. A lot of these devices have embedded web servers. Since most users never access them they go forgot about. If malware gets a foot hold in your network, it may scan for devices that have known vulnerabilities. Malware is increasing in sophistication and looks for areas to hide that are not normally checked or updated. While attacks on printers etc are rare, they do offer a weak security link that could become an issue.

It is important to update all these devices on a regular schedule to close that gap of a potential security breach. Examples of breaches are the Home Depot case study, and Target attacks in which devices, etc were not patched and that lead to the exploitations. These examples allowed remote attackers control over their networks, servers and point of sale devices. More recent firmware issue example is the Lenovo UEFI exploit was found on ThinkPad and HP systems. For details review the Lenovo Security Advisor LEN-6718.

Your best defense is to keep all your devices updated and current.

That said also expect issues with updates. This is a primary reason a lot of devices do not get updated. The updates can deprecate old features, change the way things work and be disruptive. However while that maybe true, it could be more disruptive if malware gains a foothold into your network on an unpatched device, and repeatedly re-infecting other devices, computers, etc.

Ideally one would want to update as soon as a patch is released. However many vendors do not do a good job at communicating an update, or if you are not an a vendor’s mailing list you may not get the update.  So a practical approach is to check the devices in your inventory and look up the latest firmware version. Next read about the update and do a web search for any known issues with the update. Then install and test the update. Fall back to an older update if issues occur and if the device allows a down grade.

Lastly update your documentation or management software. Then add the next firmware update review on your calendar or task management system.

If issues do arise from the updates please open a EFS Network Management Support Request and we will take a look at the issues or you can contact us for help.