In this section of the course,
we are going to discuss Hardware Security.
The Hardware Security section of the course focuses
on Domain 3: Security Engineering,
specifically Objective 3.4,
which states that given a scenario,
you must be able
to implement hardware security technologies and technique.
Securing hardware systems begins with ensuring the integrity
and reliability of every operation
from the moment a device powers on
to the protection of sensitive data.
The integration of specialized hardware
and encryption techniques plays a critical role
in safeguarding this information
and maintaining system resilience.
As we go through this section,
we will cover many topics related to Hardware Security,
including Roots of Trust, Boot Options,
Security Coprocessors, Self-encrypting Drives,
Host-based Encryption, Self-healing Hardware,
and Virtual Hardware.
First, we will look at Roots of Trust.
Roots of trust provide a trusted foundation
for the secure operation of devices and systems.
Roots of trust concepts include Trusted Platform Modules
or TPMs, Virtual Trusted
Platform Modules or VTPMs,
and Hardware Security Modules or HSMs.
A Trusted Platform Module is a physical chip
that is installed on a motherboard.
It securely stores cryptographic keys
and performs cryptographic operations.
A Trusted Platform Module is a hardware root of trust.
A Virtual Trusted Platform Module extends this functionality
to virtualized environments.
It provides similar security features
within virtual machines
by emulating Trusted Platform Module capabilities.
A Virtual Trusted Platform Module
is also considered a root of trust.
A Hardware Security Module is a dedicated hardware root
of trust and is often a standalone appliance
or specialized card designed to manage
and protect cryptographic keys
and perform cryptographic operations
across multiple machines.
A Hardware Security Module is not a chip installed
on a motherboard, but rather a standalone device.
In application, a physical server might utilize
a Trusted Platform Module
to secure its boot process, while virtual machines
on the same server
use Virtual Trusted Platform Module instances
to secure their own boot processes.
At the same time,
a Hardware Security Module may be employed
across multiple servers to manage
and protect the master encryption keys
for all physical and virtual systems.
This combination of Trusted Platform Module,
Virtual Trusted Platform Module,
and Hardware Security Module employment ensures
a unified root of trust that spans
the entire infrastructure.
Next, we will explore Boot Options.
Boot options are methods
and sequences that determine how a system starts
and verifies its integrity
before the operating system loads.
Boot options include Secure Boot and Measured Boot.
Secure boot ensures that each component loaded
during the boot process, including boot loaders,
operating system kernels,
and drivers has a valid digital signature.
By validating each boot process component,
secure boot prevents unauthorized code from running
during the boot process.
Measured Boot, on the other hand,
records cryptographic hashes of each component loaded
during the boot process into a Trusted Platform Module
to create a verifiable log of the boot sequence.
Measured boot is used for attestation
to detect boot file tampering.
It does not prevent malicious boot files from loading.
For example, a system might use secure boot
to load the initial firmware
and operating system loader,
while measured boot logs the integrity
of each step allowing security software
to validate the boot process against known-goods states.
After that, we will look at Security Coprocessors.
Security coprocessors
are specialized hardware components designed
to perform cryptographic operations
and store sensitive data in a protected environment.
Security coprocessor concepts
include CPU security extensions and secure enclaves.
CPU security extensions,
such as Intel's Trusted Execution Technology
and AMD's Secure Encrypted Virtualization,
provide hardware-based protection for critical processes
and data by creating secure execution environments.
A secure execution environment is a protected area
within a computing system that isolates
and secures sensitive data
and processes from unauthorized access and tampering.
Secure Enclave is a secure execution environment
that operates separate from the main CPU
and is specific to Apple hardware.
Secure Enclave operates like CPU security extensions
by isolating sensitive data
and operations from the rest of the system.
However, Secure Enclave is used primarily
for storing encryption keys
and performing secure transactions.
In application, a system might use CPU Security Extensions
to create a trusted execution environment
for security-sensitive applications,
while Secure Enclave ensures cryptographic keys used
by these applications are stored
and managed securely.
This prevents unauthorized access,
even if the main operating system is compromised.
Next, we will explore Self-encrypting Drives.
Self-encrypting drives are storage devices
with built-in encryption capabilities
that automatically encrypt
and decrypt data as it is written to or read from the drive.
Self-encrypting drives operate using
an onboarding encryption engine
to encrypt data transparently
without requiring user interaction or additional software.
Implementation of self-encrypting drives involves
integrating encryption algorithms
and a secure key management system directly into the drive.
Self-encrypting Drives streamline deployment
and provide better security
than software-based encryption solutions.
The advantages of Self-encrypting Drives
include ease of use, consistent performance,
and robust protection against data breaches.
Following that, we will look at Host-based Encryption.
Host-based encryption is encryption of data managed
and controlled by the local operating system.
Both Windows and Linux-based operating systems employ
a type of host-based encryption.
In Windows, file and volume level host-based encryption
is offered by BitLocker.
In Linux, the Linux Unified Key Setup or LUKS,
is used to encrypt disc partitions and files.
Next, we will explore Self-healing Hardware.
Self-healing hardware has the capability
to automatically detect, correct,
and recover from its own faults or damage.
Self-healing hardware concepts include efficiency,
durability, sustainability, and innovation.
Let's take a moment to define each of these concepts.
Efficiency in self-healing hardware is achieved
through mechanisms that enable quick fault detection
and automated repair processes to minimize downtime.
Durability is enhanced by the hardware's ability
to recover from physical
and logical failures,
reducing the likelihood of a complete system failure.
Sustainability in self-healing hardware is realized
by extending the hardware's lifecycle
and reducing the need for frequent replacements.
Innovation in self-healing hardware drives the development
of advanced diagnostic and repair technologies.
In practice, modern self-healing server systems equipped
with Redundant Array of Independent Discs
or RAID configurations can automatically detect
and rebuild failed disk drives,
ensuring data integrity and system reliability
without significant user intervention.
Finally, we will look at Virtual Hardware.
Virtual hardware is simulated hardware that is created
and managed by hypervisor software
to provide a virtualized hardware environment
for running operating systems and applications.
Virtual hardware concepts include scalability, efficiency,
and cost-effectiveness.
Virtual hardware enables scalability
by allowing multiple virtual machines
to run on a single physical server,
dynamically allocating resources such as CPU, memory,
and storage as needed.
Efficiency in virtual hardware is achieved
through optimized resource usage
and the ability to quickly deploy
and manage virtual environments without the need
for physical hardware changes.
Cost-effectiveness in virtual hardware is realized
by reducing the need for physical hardware investments
and lowering operational costs
through consolidated infrastructure.
For example, VMware's vSphere
can create multiple virtual machines
on a single physical server,
efficiently scaling resources based on workload demands.
By scaling virtual resources,
hardware costs are reduced
and overall system efficiency is improved.
To finish things off,
we'll take a short quiz to see what you learned
during this section of the course,
and we'll review each of those quiz questions fully
to ensure you could explain why the right answers were right
and the wrong answers were wrong.
So, let's get ready to dive into Hardware Security
in this section of the course!