This security plus covers all kinds of hardware and firmware security and to lump it all together a
little bit.
I'm using this episode as my potpourri section to make sure that I'm covering a broad cross-section
of objectives that definitely fit under the idea of hardware and firmware security so bear with me as
we bounce through a couple of small but important different types of topics well more than a couple
anyway.
Let's go ahead and get started with the concept of full description or F.D. the best security you can
do for mass storage is to encrypt your mass storage and full disk encryption is one methodology that
we do this.
Now typically when we talk about full disk encryption we're talking about using software or firmware
based tools in the Windows world.
We use something called Bit locker now that Lochore takes advantage of the concept of Trusted Platform
Module.
This is something that's built into pretty much all modern motherboards where you have a little chip
on there that stores a unique key for that system.
We're going to enable bit locker on this system and the nice part is that if this hard drive is ever
separated from this motherboard there is no way that anybody is going to be able to get to the data.
So let's go and get started and fire up a bit locker on the system right here.
So I'm just going to run over to the bit locker configuration.
There it is.
Right now you can see that locker is off.
And let's go in and turn it on.
This device can use a Trusted Platform Module.
Wait a minute.
All it's saying to me right now is that TPM has not been turned on and this is a big problem with bit
locker and other full disk encryption tools.
If the TPM isn't enabled and running we're in trouble.
So what we're going to have to do is let's jump into bias real quick turn on TPM.
So now that we're in our bias let's figure out where we have to go to turn on TPM.
So on this one just because I've done it before it's right up here at the top Intel platform trust technology
that is despite whether they say it or not that is TPM.
So let's go ahead and enable that.
Now we're going to have to reboot.
But this is ready to go.
OK we're all rebooted.
Let's try bit locker one more time.
Now this time now that I have the TPM module turned on it should kick right over.
OK.
All right.
Now the first thing it's going to ask is once the recovery key This can be really important.
If by some chance the motherboard died.
For example I wouldn't have the key the TPM module would be destroyed and the data would be lost so
you could actually make yourself a recovery key.
You can store it in a Microsoft account.
You can actually printed out on paper if you want.
And it would only be used if the actual motherboard itself was destroyed in some way.
Otherwise you're not going to get this data back.
And by the way when I say you're not going to get this data back the United States Department of Justice
who I've done a lot of business with is unable to currently crack that locker.
It's a very very powerful encryption.
Now what I'm going to do right now is I'm going to cancel this simply because running bit locker can
take a very very long time on the initial time and we don't need to watch a progress bar move along.
Now Bilker is great and full disk encryption is amazing.
But for a lot of people they want to make it even a little bit easier.
And that's where we get into something like this.
What I've got here is a hard drive which is self encrypting.
You actually buy the hard drive like this and it's ready to be completely self encrypted it's got all
of the TPM ESC module built into the drive itself.
When I plug this into a system when I first boot it up a little thing pops up and says Please give a
password for this drive.
What's that password is generated every time this drive is accessed or at least during boot every time
when this drive is access you have to enter that password and do not ever lose it because if you do
my friends you will literally never get that data back.
However it's incredibly convenient and a lot of people as opposed to using things like bit locker much
prefer self encrypting drives.
All right.
Well that's it for drives.
Now let's take a minute and let's talk about something called Secure boot.
People get pretty paranoid about their systems.
If you think about the last 30 plus years of malware and evil things that have happened to systems the
idea of being able to protect your system with hardware and firmware is a very attractive option.
TPM which is great as a trusted platform module goes way beyond simply activating bit Locher the current
TPM standard TPM 2.0 include something called Secure boot.
The whole idea behind secure boot is that your operating system your complete system every time it boots
sort of checks the quality of everything that's in it.
Any firmware any applications and everything everything must be signed.
Amazing huh.
Now that does get a little bit big brother Fearn Linux users and people like that.
The fact that they can't play with the boot sectors or anything without the system completely going
nuts can be very very frustrating.
But like within the Windows world with Windows 10 you're required to use secure boot.
It's part of the operating system now.
It's sometimes though we don't really like big brother that can be a great example.
Your car probably has an embedded operating system and probably has two or three.
So just imagine that big navigation computer at the very front of your system how would you like a bad
guy putting something in there and causing trouble.
Or your smartphone.
How about some evil person injecting some malware into it.
Those are places where suddenly I become to love Big Brother.
I'm sorry 1984 but the bottom line is is that by doing stuff like this we create what's known as a hardware
route of trust.
We have a big brother or it could be Microsoft or somebody like that or Intel who has in essence a root
certificate that everybody signs from anybody attempting to inject anything into these embedded systems
will prevent the system from booting up.
In most cases depending on the operating system it can literally go back to a snapshot automatically
before anything was injected and things like cars and things like smartphones.
It's really really difficult to put malware onto them anymore because of a properly handled secure boot.
More than that it even forces a secure supply chain.
If anybody wants to have anything to add to for example your Apple phone they have to go through Apple
and they have to be certified.
They have to be placed into the Apple store in such a way that we can count on them a high degree of
security.
So there's times where you can love secure boot.
Probably not so much on desktops but by golly on embedded systems it's a real attractive option.
All right there's one more thing I'd like to add and that is something that I'm not even sure why I
come to you.
Put it in.
It's not that it's unimportant but it's kind of rare.
It's called a hardware security module.
In this world with all these certificates and everybody signing everything you can put a lot of work
load on your you just checking certificates checking digital signatures go into the calculations to
confirm somebody is good.
So what we can do and this is fairly easily done is we can get a hardware security module hardware security
modules are nothing but hardware whose only job is to calculate and check signage to make sure everything's
OK.
They can store keys.
They can do whatever you need to within the world of signing to make sure everything's OK.
We see this a lot for example with web servers.
I've got a web server and each one of these Web services running HD CPS as opposed to making server
work so hard.
A lot of companies will just put a big HSM box in there that everybody plugs into and it handles all
the signing for it.
Equally I think I actually have a picture this to have.
OK so look at this.
So this is actually a card that we can snap into a computer and we call this an HSA card and it handles
it all for us.
Now keep in mind that H S M is really going to be used in places where there's a lot of signing going
on your regular desktop your regular Android smartphone.
They can handle what they need internally.
We're talking about server type situations where there's a lot of people coming onboard.