Chapter 2 — PC hardware and firmware | Technical Systems, endpoints and hardware security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 2 — PC hardware and firmware

Lesson map

Lesson 02 published. Map, example, EX005.

flowchart TD
  N0["Learning outcomes"]
  N1["2.1 Components"]
  N2["2.2 UEFI settings"]
  N3["2.3 Firmware passwords"]
  N4["2.4 Recording details"]
  N5["Firmware updates"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX005"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["2.1 Components"]
  N2["2.2 UEFI settings"]
  N3["2.3 Firmware passwords"]
  N4["2.4 Recording details"]
  N5["Firmware updates"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX005"]

[Learning outcomes]
    |
    v
[2.1 Components]
    |
    v
[2.2 UEFI settings]
    |
    v
[2.3 Firmware passwords]
    |
    v
[2.4 Recording details]
    |
    v
[Firmware updates]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX005]

Learning outcomes

You will (1) identify PC components; (2) check firmware settings; (3) record hardware details.

2.1 Components

A PC contains a processor, memory, a storage drive, network adapters and a motherboard with firmware. Knowing these helps diagnose faults and plan upgrades. For security, the storage drive matters because it holds data that must be protected if the PC is stolen or disposed of, and the firmware matters because it starts everything else. At Harlow & Pike, the drive matters because accountants' laptops carry client financial records, which BitLocker will later protect. Nadia notes each PC's components in the inventory, which also helps when the supplier plans replacements for the oldest models.

2.2 UEFI settings

The firmware, usually UEFI, has settings for boot order, Secure Boot and the TPM. Secure Boot checks that the startup software is signed by a trusted publisher. The TPM is a chip that stores keys used by BitLocker. Nadia checks these settings on three PCs using the firmware setup screen and the Windows System Information tool, only looking, not changing. Only looking means she cannot break a PC or lock a user out while learning. The results go into the inventory and tell her which PCs are ready for BitLocker, since the oldest has its TPM disabled.

2.3 Firmware passwords

A firmware administrator password stops someone from changing boot settings, for example to start the PC from a USB stick and bypass Windows. Harlow & Pike's PCs have none. Lena agrees that the IT supplier will set one, stored in the password manager. Without a firmware password, anyone with a few minutes alone with a PC could change boot settings and get around Windows protections. Storing the password in the manager means the supplier can still change settings when needed. Nadia records which PCs have the password set and checks the list again after the supplier finishes.

2.4 Recording details

Nadia records for each PC: model, serial number, TPM present and enabled, Secure Boot on or off, and firmware version. This takes ten minutes per PC and gives a clear picture of which PCs are ready for encryption. Recording the firmware version also shows which PCs need updates from the manufacturer. Nadia stores the details in the office inventory, so they are available when the supplier enables BitLocker. She repeats the check on the remaining PCs over the following weeks, a few at a time, so office work is not disrupted.

Firmware updates

PC makers release firmware updates that fix security flaws in the code that runs before Windows starts. Because firmware sits below the operating system, a flaw there can survive a Windows reinstall, which makes these updates more important than their low profile suggests. NIST SP 800-147 describes how firmware updates should be authenticated so that only the maker's signed updates are accepted. The supplier enables firmware updates through Windows Update for supported models, so firmware stays current without visiting each desk. Updates are applied only when the PC is on mains power, since an interrupted firmware update can leave a PC unable to start, and the firmware version is recorded in the inventory.

Worked example

Of the three PCs checked, two have TPM 2.0 enabled and Secure Boot on; the oldest has the TPM disabled in firmware, noted for the encryption chapter.

Synthetic case. Details are synthetic.

Errors and limits

Changing firmware settings without a plan can stop a PC starting; Nadia only records them.

Exercises

EX005 — Secure Boot purpose. What does Secure Boot check? Rubric: 3 = signed trusted startup software;; 2 = startup;; 1 = vague;; 0 = none.
EX006 — Firmware password value. Explain why a firmware password helps. Rubric: 3 = prevents changing boot settings to bypass Windows;; 2 = protection;; 1 = vague;; 0 = none.
EX007 — Hardware record. List five details to record per PC. Rubric: 3 = all five;; 2 = four;; 1 = fewer;; 0 = none.
EX008 — Disabled TPM. What should happen with a PC whose TPM is disabled? Rubric: 3 = plan to enable before encryption, by IT;; 2 = enable;; 1 = ignore;; 0 = none.

Synthesis

Firmware settings are part of a PC's security and belong in its record.

Continue studying — chapter 02 of 18

← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →