CoreQ Academy3.4 Given a scenario, implement hardware security technologies and techniques.
Hardware is the foundation of trust. If firmware or hardware is compromised, nothing above it can be trusted, so trust is anchored in dedicated chips and verified at boot.
Roots of trust
- Trusted Platform Module (TPM)
- Chip that stores keys, measures boot components and supports disk encryption and attestation.
- Hardware Security Module (HSM)
- Tamper-resistant appliance for high-value key operations.
- Virtual Trusted Platform Module (vTPM)
- A TPM provided to virtual machines by the hypervisor, enabling VM disk encryption and attestation.
Security coprocessors
- Central processing unit (CPU) security extensions
- Processor features such as Intel SGX/TDX, AMD SEV and ARM TrustZone that isolate code and memory.
- Secure enclave
- An isolated execution area protecting keys and sensitive processing from the main OS.
Platform protections
- Virtual hardware
- Emulated devices for VMs; keep hypervisor and virtual device drivers patched.
- Host-based encryption
- Encryption performed by the host OS or hypervisor for disks and data.
- Self-encrypting drive (SED)
- Drive hardware encrypts all data transparently; supports instant crypto-erase.
- Secure Boot
- UEFI verifies signatures of bootloaders and drivers so only trusted code runs at startup.
- Measured boot
- Each boot component is measured (hashed) into the TPM so its state can be attested remotely.
- Self-healing hardware
- Firmware that detects corruption and restores itself from a protected golden copy.
- Tamper detection and countermeasures
- Sensors and seals that detect physical tampering and respond, e.g. by wiping keys.
Threat-actor TTPs
- Firmware tampering
- Modifying firmware to gain persistent, stealthy control.
- Shimming
- Inserting a thin device or code layer between components, e.g. card skimming shims or driver shims.
- Universal Serial Bus (USB)-based attacks
- Malicious USB devices that act as keyboards, network adapters or deliver malware.
- Basic input/output system/Unified Extensible Firmware Interface (BIOS/UEFI)
- Bootkits that infect firmware below the OS; defend with Secure Boot and firmware updates.
- Memory
- Attacks on RAM such as cold-boot or DMA attacks; defend with memory encryption and IOMMU/Kernel DMA protection.
- Electromagnetic interference (EMI)
- Disrupting or eavesdropping on electronics through electromagnetic noise; shielding helps.
- Electromagnetic pulse (EMP)
- A burst of energy that can damage electronics; relevant to critical infrastructure resilience.
Check your understanding
Loading quiz…
Original CoreQ Academy material, mapped to objective 3.4 of the publicly available CompTIA SecurityX CAS-005 exam objectives (Exam objectives V5, document version 7.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.