What mechanisms does Meraki use to validate firmware integrity when auto updating thru M.Dashboard?

[JFR]

Edit: Resolved

---

Hello,

As part of NERC CIP-013-2, I need to validate if/how firmware integrity is validated when auto updating thru Meraki Dashboard.

I wasn't able to find a clear answer on this from the Trust Portal, Datasheet, Whitepapers, Google Searches.

Thanks,

[Mloraditch]

This may not be public for security reasons. I've never seen any level of detail on the process even close to this. You may need to contact support or possibly your account manager if the info is available under NDA.

[JFR]

Only need to find black on white that the firmware upgrade process has mechanisms to validate firmware integrity. Otherwise, I need to document how we "verify software integrity and authenticity of all software and patches provided by the vendor". 

I'm expecting this to be built in, but my assumptions won't hold in audit.

[RWelch]

This white paper addresses the applicability of the Cisco Grid Security solution in response to NERC CIP mandates.

NERC CIP Compliance White Paper 

[JFR]

I've seen this but it doesn't address the issue.

[alemabrahao]

No specific details are publicly available, probably for security reasons, but I believe some general practices are involved, such as:

Firmware updates are usually signed with a digital signature to verify their authenticity and integrity. This ensures that the firmware has not been tampered with and is from a trusted source.

Devices may use secure boot processes that only allow firmware with a valid digital signature to be loaded and executed.

Before applying the firmware update, the system may calculate and verify the hash of the firmware file to ensure that it matches the expected value.

You might want to contact Meraki to see if they have any detailed information or even documentation.

[Main10ence]

@JFR  Hello, 

I agree with @alemabrahao. You may want to speak to your Cisco Meraki rep to see how much "sanitized" information you can get on how Cisco Meraki devices validate and authenticate to the cloud for firmware management. 

What @alemabrahao described can be considered as general process that is used. 

[PhilipDAth]

https://meraki.cisco.com/trust/

[JFR · Accepted solution]

The information is here:

Meraki Cloud Architecture - Cisco Meraki Documentation

Hardware and Software Security

Meraki leverages technology such as secure boot, firmware image signing, and hardware trust anchors as part of the Cisco Secure Development lifecycle to maintain hardware and software integrity.

And our Cisco Meraki technical reps confirmed that Meraki has secure boot as a standard.

[RWelch]

You should accept YOUR response as the solution (to help others later down the road).

Nice work!!  👏  👏 👏

[CarolineS]

@RWelch I did it for them! Thanks for coming back with the info, @JFR!