In this lesson,
we will learn about roots of trust.
Roots of trust are the foundation
upon which all secure operations
of a computing system depend.
Roots of trust contain the keys
used for cryptographic functions
and enable a secure boot process.
They are inherently trusted
and therefore must be secure by design.
Roots of trust concepts
include Trusted Platform Modules or TPMs,
Virtual TPMs or vTPMs,
and Hardware Security Modules for HSMs.
Let's learn more about roots of trust concepts.
First, we have Trusted Platform Modules or TPMs.
A TPM is a physical chip installed on a motherboard
that acts as a hardware root of trust
located within the BIOS of your system.
The TPM securely stores cryptographic keys,
digital certificates, hashed passwords,
and performs cryptographic operations.
The TPM plays a critical role in ensuring secure boot
and system integrity by validating the BIOS,
operating system, and other critical components
during startup to ensure they have not been tampered with.
TPMs generate and manage cryptographic keys,
including RSA keys,
and they use a true random number generator
to support secure key creation.
The TPM includes persistent memory
for crucial keys like the endorsement key
and storage root key, along with versatile memory
for storing platform configuration registers
and attestation identity keys.
In application, a physical server uses its TPM
to secure its boot process,
ensuring that it starts up in a secure state.
TPMs also work with full disk encryption solutions
like BitLocker, using stored encryption keys
to keep data safe even if a device is lost or stolen.
Wow, that is a lot of functionality
located in this one little TPM chip.
So you are probably wondering,
"Do I have to memorize all of those different things,
all of those different keys for the exam?"
Well, no, not really.
Instead, you really need to remember
that the Trusted Platform Module or TPM
is a hardware route of trust,
and that it helps ensure your system boots securely.
It does this by a testing
that the BIOS has not been modified
and that the firmware can be trusted.
Additionally, for the exam,
you do not need to know how to modify or configure your TPM.
However, in the real world,
you may be asked to work with them,
so it's important to be familiar with the process.
So if needed, you could always refer
to the latest documentation on microsoft.com
for guidance on how to properly modify
and configure your TPM based on your specific needs.
Second, we have Virtual Trusted Platform Modules or vTPMs.
vTPMs Extend the functionality
of physical TPMs into virtualized environments.
Unlike physical TPMs, which are hardware based,
vTPMs are software implementations
that emulate the security features of TPMs
within virtual machines,
providing a virtual route of trust.
vTPMs generate and manage cryptographic keys,
secure the boot process of virtual machines,
and validate system integrity just like physical TPMs.
They handle key generation, encryption, decryption,
and signature verification,
allowing virtual machines to achieve
the same level of security as physical devices.
Managed through platforms like VMware or Microsoft Hyper-V,
vTPMs allow virtual instances
to maintain individual security postures
while benefiting from the same attestation
and cryptographic capabilities provided by physical TPMs.
In practice, virtual machines on a physical server
utilize vTPM instances to secure their own boot processes,
creating a consistent security approach
across both physical and virtual environments.
For the exam,
focus your studies on the distinguishing features of a TPM,
a vTPM, and a hardware security module or HSM,
which we'll talk about in just a minute.
In this case,
a vTPM provides the same functionality as a TPM,
but is designed specifically for virtual machines,
offering similar security measures
in a virtualized environment.
Third and last,
we have Hardware Security Modules or HSMs.
HSMs are dedicated hardware roots of trust
designed to manage and protect cryptographic keys
and perform cryptographic operations
across multiple machines.
Unlike TPMs, which are embedded on individual motherboards,
HSMs are standalone appliances
or specialized cards that offer a high security
for key management, encryption, decryption,
and digital signatures on a larger scale
and across multiple devices.
HSMs are used in enterprise environments
to handle cryptographic tasks
that require robust protections against tampering
and insider threats.
They also provide a secure environment for generating keys
such as RSA, Elliptic Curve, and AES keys.
They also store these keys securely
to prevent unauthorized access.
HSMs are commonly used
to protect master encryption keys across physical servers
and virtual machines,
ensuring centralized secure key management.
In application,
Hardware Security Modules can be used to manage
and protect encryption keys for multiple servers.
So HSMs are dedicated hardware devices
designed to manage and protect cryptographic keys
and perform cryptographic operations
across multiple machines.
So HSMs are used in various business cases,
including managing key pairs for public key infrastructure,
encrypting PINs for payment card systems,
processing transport layer security or TLS connections,
and signing large DNS zone files.
They provide a secure environment for generating
and storing keys like RSA, Elliptic Curve, and AES keys,
which we've already mentioned.
This ensures centralized
and secure key management across physical servers
and virtual machines.
Designed to be tamper evident,
HSMs also help mitigate insider threats
and provide robust security for sensitive data.
However, they can be expensive
due to their specialized hardware,
and they can be difficult to upgrade
due to their physical nature.
So remember, roots of trust are critical components
that provide the secure foundation
for all operations in a computing system.
They manage cryptographic keys, validate system integrity,
and ensure secure boot processes,
making them inherently trusted and secure by design.
Roots of trust include Trusted Platform Modules,
Virtual Trusted Platform Modules,
and Hardware Security Modules,
each serving specific security needs
in different environments.
Trusted Platform Modules or TPMs
are physical chips embedded in systems
to manage keys and validate boot integrity.
Virtual Trusted Platform Modules or vTPMs
extend physical TPM capabilities to virtual machines,
offering similar security,
but within virtualized environments.
Finally, Hardware Security Modules or HSMs
are standalone devices
that provide high level cryptographic key management
across multiple machines,
ensuring robust protection against tampering
and unauthorized access in enterprise settings.