What is firmware?

Many devices rely on firmware to function, including TVs, cameras, mobile phones, printers, drives and more. Firmware is located in a device’s nonvolatile memory, where content can be stored when a device is off. Firmware can be written to different memory types including, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM) and flash memory.  

Firmware helps devices perform their intended functions in several important ways, including delivering the instructions for how the device should start up, how it should interact with other devices—such as Internet routers or remote controls—and how it should perform critical input/output(I/O) tasks. Many manufacturers of hardware devices, such as Apple, LG Electronics, Microsoft and more, embed firmware into their products so they function similarly to a computer’s operating system (OS).

The term ‘‘firmware’’ was reportedly first used by the American scientist Ascher Opler in 1967 to describe a program that he said was ‘‘in-between hardware and software¹.’’ Today, firmware is an essential part of many devices, from your iPhone, Mac or TV remote, to complex Internet of Things (IoT) sensors on satellites and driverless cars. Although firmware and software are similar, there are important differences worth considering when assessing suitability for a business need.

The simplest way to understand the difference between firmware and software is in their unique purposes: While firmware was designed to help devices start up and communicate with each other, software is primarily used for interaction. Firmware is used to provide control over consumer devices, such as phones and TVs. Manufacturers frequently update firmware to add new features, enhance security and protect against vulnerabilities. As any user of an Android or iOS phone—or even Smart TVs and gaming consoles—know, firmware version updates need to be downloaded and installed regularly or they affect device performance.

Software, on the other hand, is installed on a device to improve user interaction with activities like browsing the Internet, checking email, word processing, watching videos, streaming music and more. Software isn’t as closely connected to the hardware as firmware and needs firmware to communicate with the hardware its providing functions for.

Firmware is essential to the proper functioning of devices that we take for granted in our work and personal lives, such as personal computers (PCs), smartphones, gaming consoles and more. Most users of these devices are familiar with firmware through frequent ‘‘firmware updates’’ that are necessary to keep their devices working. 

Firmware updates, which consist of computer code, are often issued to fix security threats that can impact a device’s performance such as bugs or hacks. But they can also be issued to add a new feature to a device, such as a way for it to interact with a new kind of media. Examples of firmware updates include adding security features to an Internet router, improving the browsing function for a streaming video app and an Operating System (OS) update that allows a computer system board to support a new kind of processor.

Since today, most devices are connected to the Internet, downloading updates remotely, or “over the air,” has become a way for manufacturers to issue firmware updates. Most program the ability to update a device into the firmware and the user simply receives a notification. Other devices still require users to visit a manufacturer’s website and download the necessary code. The frequency of firmware updates varies depending on the type of device that it was designed for. Smartphones, for example, typically combine firmware and software updates to keep the phone and its underlying OS functioning properly.

Because firmware is so widely used and is essential to the functions of so many important devices, it has become a significant target for hackers. Hardware devices that rely on firmware have many vulnerabilities because they frequently use the same code. Laptops, for example, which often contain sensitive work information, rely on firmware to power their batteries, sound and video cards, webcams and more, making them attractive targets. 

Firmware hacking often involves the deployment of malware, code that’s been intentionally written to harm a computer’s system or user by attaching itself to firmware. Popular types of malware include ransomware that holds a user’s data hostage, Trojan horses that evade detection by posing as a legitimate program and spyware that steals sensitive information about a user. Hackers rarely have to physically access a machine to exploit, they can gain access remotely by using Bluetooth or Wi-Fi connections, increasingly popular as the number of devices with Internet connections increases. 

Poor firmware security features can result in sensitive user data being stolen or compromised and bad actors gaining remote control over a user’s machine. For example, in June of 2024, Google issued a warning that a problem with its Pixel Firmware made it vulnerable to attackers and that there was no known fix for the problem².

Enterprises, increasingly aware of the risk of firmware vulnerabilities, are taking increased measures to prevent exploitation of their systems because of the many benefits firmware offers. 

Improved performance—without new hardware: Firmware updates allow devices to take on new capabilities without changing the device or its architecture. Many firmware updates improve execution and instruction times for a device’s underlying code and help optimize its performance.

Improved user experience: Firmware updates give users new features, computer programs and functions for activities they rely on, such as checking account balances, recording a show on their Smart TV or knowing which groceries to buy, by connecting their Smart Refrigerator to an app via IoT capabilities.

Faster issue resolution: Firmware updates allow many common issues with a device to be resolved swiftly, including boot and processing times, more multitasking functions and better compatibility with external devices.

Component functions: Firmware updates help ensure that all peripheral components of a device, such as the speakers and microphones on a smartphone, work the way they were designed to, enabling the device to perform at peak levels.

Reduced repair costs: Keeping device firmware updated helps reduce the likelihood that devices will be infected by bugs and require bug fixes or costly equipment repair in the future.   

Firmware is installed on a device while the device is being manufactured. Primarily, it facilitates communications between the operating system (OS) and the device’s hardware. Firmware contains many instructions that are essential to the device functioning in the way it was designed. The computer’s central processing unit (CPU), the place where data input is transformed into information output, retrieves firmware from a computer’s memory and runs it.

Firmware is used on many devices that we rely on every day. Perhaps its most common use case is the waking up of a device after a long period of inactivity.  After you’ve gone to sleep, for example, and you wake up and glance at your phone to check your messages, the firmware is helping ensure your device powers up properly. To retain information while it isn’t being used, a device stores firmware in its ‘‘nonvolatile’’ memory. As the complexity of tasks required of firmware has increased, it has taken on some of the characteristics of computer hardware, namely its use of flash memory and a Basic Input/Output System, or BIOS.

Because many devices need to retain information while they’re switched off, firmware typically stores data in a system’s ‘‘nonvolatile,’’ or ‘‘read-only’’ memory (ROM), also known as flash memory. This type of memory is used in a wide range of portable devices such as flash drives, smartphones, digital cameras, laptops and more, and is essential to firmware’s functions. 

Recently, flash memory has gained some of the same capabilities associated with computers. For example, when a computer is booted up, it goes through a sequence known as Basic Input/Output System, or BIOS. The first firmware to run a BIOS sequence used a ROM chip, now systems have switched to using flash memory for BIOS so data can be rewritten without the chip having to be removed from the system board and reinserted once it’s been reprogrammed.

In addition to changes in the way firmware uses and stores memory, there have been advancements in the types of firmware available to users as well. Today, firmware can be categorized into three basic groups defined by its architecture: 

• low-level firmware
  
• high-level firmware 
• subsystem firmware

Low-level firmware is intrinsic to a device’s hardware and stored on nonvolatile, read-only chips, like ROM, which can’t be updated. Devices that rely on low-level firmware use memory that can only be written once and never reprogrammed.

High-level firmware is firmware that can’t be updated because of the complexity of its hardware. In a computer, high-level firmware is contained in flash memory chips and is responsible for more advanced tasks than low-level firmware. High-level firmware contains important instructions for how a device functions and various components interact.

Subsystem firmware is contained in what’s known as an ‘‘embedded system,’’ a specific combination of hardware and software designed for a purpose or task. Subsystem firmware is similar to high-level firmware in its complexity and adaptability. Like high-level firmware, subsystem firmware can be easily updated.

Firmware is used in a wide range of devices critical to digital transformation, and therefore has many useful applications for the modern enterprise. Some of the more common business uses of firmware include:

• personal computers (PCs)
• data storage 
• smartphones
• cars
• Internet of Things (IoT) devices

Personal computers

Personal computers (PCs) rely on firmware to retain critical data while they’re powered down, as well as BIOS and Unified Extensible Firmware Interfaces (UEFI) specifications for the software interface between an operating system and firmware. Typically, these features come embedded on a memory chip on a computer’s system board. Also, popular PC components such as graphics and video cards also rely on firmware to function.

Data storage devices

USB drives, external hard disk drives disk, flash drives and other portable data storage devices require firmware to function. Firmware is built into the flash memory chips that many modern data storage devices rely on and can be updated easily unlike firmware contained in ROM or EPROM. 

Smartphones

Smartphones rely heavily on firmware to function. Not only does firmware help ensure that a smartphone will boot up after you haven’t used it in a while, but it also helps ensure that critical components can interact with each other the way they were designed to. Lastly, in a smartphone, bug fixes, security features and new capabilities all depend on regular firmware updates downloaded from the Internet to work properly.

Cars

Many cars designed in the last ten years contain computers that rely on firmware to perform critical tasks. Different types of firmware are used across various automotive systems including engine control units (ECUs) that optimize engine performance and fuel efficiency, and the increasingly complex information and entertainment systems (infotainment) that assist with navigation and the cameras attached to many cars.

Internet of Things (IoT) devices

The Internet of Things (IoT) refers to a network of physical devices, vehicles, appliances and other physical objects that are embedded with sensors, software and network connectivity, allowing them to collect and share data. Firmware is essential to many IoT technology use cases, such as smart home appliances, driverless cars, smarter cities and factories and many more. On an IoT device, such as a sensor-transmitting data over the Internet, firmware contains critical instructions permanently stored in the hardware that allow the device to power up and down, collect, analyze and transmit data and more.