What does CFI mean in UNCLASSIFIED

Control Flow Integrity (CFI) is an integrity verification method used to make it harder for malicious code to execute unexpected instructions in a program's control flow.

CFI helps guard against hacking attempts and malware by making sure that program code only executes as intended. It helps detect malicious code before execution and prevents the execution of unexpected instructions that can be exploited by attackers.

Programs that depend on complex interdependencies, such as web browsers, PDF readers, and operating systems, are the most vulnerable to attacks. By proactively identifying any potential exploitation opportunities with CFI, these types of programs are better able to protect themselves from attack vectors targeting them.

While implementing CFI requires significant effort, it may be more cost-effective in the long run than frequent security patching. Due to its added layer of protection, implementing CFI can ultimately save money since there will be fewer patches needed over time.

The main drawback of using CFI is the increased complexity and resources necessary for implementation. Additionally, it has been found that some optimizations performed on executable binaries can reduce their security without reducing performance, so some care must be taken when optimizing in order not to reduce the effectiveness of CFI protections.