Chapter 2 — Hardware and firmware basics
Lesson map
Lesson 02 published. Map, example, EX004.
flowchart TD
N0["Learning outcomes"]
N1["2.1 Inside the machine"]
N2["2.2 Secure boot and the TPM"]
N3["2.3 Firmware needs updates too"]
N4["2.4 Recording hardware facts"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX004"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["2.1 Inside the machine"]
N2["2.2 Secure boot and the TPM"]
N3["2.3 Firmware needs updates too"]
N4["2.4 Recording hardware facts"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX004"]
[Learning outcomes]
|
v
[2.1 Inside the machine]
|
v
[2.2 Secure boot and the TPM]
|
v
[2.3 Firmware needs updates too]
|
v
[2.4 Recording hardware facts]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX004]
Learning outcomes
You will (1) name the main parts of a computer; (2) explain firmware and secure boot; (3) record hardware facts in an inventory.
2.1 Inside the machine
A laptop or server has a processor, memory, storage, network interfaces and firmware. Firmware is the low-level software stored on the motherboard that starts the machine before the operating system. On modern machines this is UEFI. Storage may be a solid-state drive, which matters for encryption speed and for secure wiping when devices are disposed of.
Tomás records the storage type for each laptop, because solid-state drives need the vendor's secure erase at disposal rather than simple overwriting. He also notes that network interfaces count as hardware facts, since a laptop with both a wired and a wireless interface can sit on two networks at the same time.
2.2 Secure boot and the TPM
Secure Boot is a UEFI feature that checks the digital signature of each startup component, so that only trusted boot loaders and operating system kernels run. A Trusted Platform Module, or TPM, is a small security chip that can store keys and record measurements of the startup process. Windows BitLocker uses the TPM to unlock the disk only when the startup looks unchanged. NIST SP 800-147 describes how BIOS and firmware updates should be authenticated, and SP 800-193 describes firmware resiliency.
On the trust's laptops both features matter in practice, because BitLocker with a TPM only protects as intended when Secure Boot is on and the TPM is enabled.
2.3 Firmware needs updates too
Firmware has flaws like any software. Laptop vendors release firmware updates through their own tools or through Windows Update. Tomás checks five of the trust's laptops and finds three are several versions behind. He notes this for the patching work later, because firmware is often forgotten when people think of patching.
Before guessing at a cause, he checks whether the three outdated laptops share a model, since a model the vendor's tool no longer reaches would explain the gap across the fleet. He records models and versions rather than updating anything, because a firmware update interrupted by a flat battery can leave a laptop unable to start, and Dev decides when updates run.
2.4 Recording hardware facts
For the inventory, Tomás records for each laptop the model, serial number, whether a TPM is present and enabled, Secure Boot state and firmware version. These few fields answer later questions: can this laptop use BitLocker with a TPM, is its firmware current, and is it old enough to replace?
He collects the fields from the management service's hardware report where possible and checks the system information tool by hand only on laptops the report does not cover. Each entry carries the date it was checked, because a firmware version recorded last year says little about the laptop today, and a TPM can be switched off later in firmware settings.
Worked example
On a test laptop Tomás opens the system information tool, finds Secure Boot on and TPM version 2.0 ready, and records both with the firmware version and the date checked.
Synthetic case. Device details are synthetic.
Errors and limits
A machine can have a TPM that is disabled in firmware settings; always record whether it is enabled, not just present.
Exercises
- EX004 — Firmware role. In your own words, what does firmware do? Rubric: 3 = starts hardware before the OS and is updatable;; 2 = starts the machine;; 1 = vague;; 0 = none.
- EX005 — TPM use. Give one practical use of a TPM on a staff laptop. Rubric: 3 = explains BitLocker unlocking based on measured startup;; 2 = names BitLocker;; 1 = vague;; 0 = none.
- EX006 — Inventory fields. Which three hardware fields help plan encryption and replacement? Rubric: 3 = TPM enabled, Secure Boot, firmware version or model age, explained;; 2 = three fields;; 1 = fewer;; 0 = none.
Synthesis
Firmware, Secure Boot and the TPM form the trust base under the operating system and belong in the inventory.
Continue studying — chapter 02 of 30
← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →