Hardware Security: TPM, Secure Boot, and Drive Encryption

When an attacker gains physical access to a device, logical security controls are severely weakened. Cold-boot attacks freeze RAM and extract encryption keys from residual data. Evil-maid attacks involve modifying a device's bootloader or OS while it is temporarily unattended. DMA attacks use physical ports (Thunderbolt, FireWire) to directly read memory. Hardware security features — TPM, Secure Boot, and full-disk encryption — work together to defend against these physical-layer attacks.

A Trusted Platform Module (TPM) is a dedicated security chip embedded in the motherboard that provides hardware-based cryptographic functions. TPM capabilities include: generating and storing cryptographic keys that cannot be extracted from the chip, measuring the boot process (Platform Configuration Registers store hashes of each boot component), sealing data to specific system states (data can only be decrypted when the system is in a trusted state), and remote attestation (proving to a remote server that the system hasn't been tampered with).

TPM 1.2 supports only RSA-1024 and SHA-1, which are now considered weak. TPM 2.0 (current standard, required by Windows 11) supports modern algorithms: RSA-2048, ECC P-256, SHA-256, AES-128/256, and algorithm agility (new algorithms can be added). TPM 2.0 also supports multiple hierarchies (endorsement, storage, platform) that enable more granular control. Enterprise environments should ensure all devices use TPM 2.0 as the baseline hardware security root of trust.

Secure Boot is a UEFI firmware feature that verifies the cryptographic signature of every piece of software in the boot chain before executing it — UEFI drivers, bootloader, OS kernel. Only software signed by keys in the firmware's Secure Boot database is permitted to execute. This prevents bootkits (malware that infects the MBR or bootloader and loads before the OS security software) and unauthorized OS installations from persisting on the device.

BitLocker is Microsoft's full-volume encryption tool, integrated into Windows 10/11 Pro and Enterprise. BitLocker encrypts the entire drive using AES-128 or AES-256 in XTS mode. Without the recovery key (stored in Active Directory or Azure AD) or a correct PIN/password at boot, the encrypted data is inaccessible — even if the drive is removed and connected to another system. When used with TPM, BitLocker seals the volume master key to specific PCR values, detecting boot tampering and requiring manual recovery if detected.

FileVault 2 is Apple's full-disk encryption for macOS, using XTS-AES-128 encryption backed by the Apple T2 chip or Apple Silicon's Secure Enclave. FileVault encrypts the entire startup volume and requires the user's login password to unlock at boot. The encryption key is tied to the user's account — iCloud recovery keys enable decryption if the password is forgotten. FileVault is essential for Mac laptops in enterprise environments, especially given how frequently MacBooks are lost or stolen at conferences and airports.

Self-Encrypting Drives (SEDs) perform encryption within the drive's hardware controller — the encryption and decryption happen at the drive level, transparent to the OS. SEDs comply with the Opal Storage Specification (TCG Opal). When the drive powers off, data is automatically locked and can only be unlocked by the correct Authentication Key (AK). SEDs offer performance advantages over software encryption (no CPU overhead) and crypto-erase capability — resetting the encryption key instantly renders all data unreadable, enabling instant secure erasure for drive decommissioning.

A cold boot attack exploits the fact that DRAM retains data for seconds to minutes after power loss. Attackers spray liquid nitrogen to extend retention, then boot a live OS to read the memory dump and extract encryption keys from RAM. Defenses include: TPM + PIN (key is in TPM, not exposed in RAM until after PIN entry), memory encryption (Intel TME or AMD SME encrypt RAM contents at the memory controller), requiring physical PIN entry at boot so that stealing a powered-off laptop means no keys are in RAM, and delayed memory clearing features in modern UEFI that zero RAM before boot.

Measured Boot uses the TPM to record hashes of every boot component into PCRs, creating a tamper-evident log of the boot process. Remote attestation sends these PCR measurements to a remote attestation server, which verifies that the system booted with only trusted, unmodified components. Enterprise technologies like Microsoft Attestation Service, Microsoft Pluton, and Intel TXT implement remote attestation. Zero Trust platforms use attestation reports as a device health signal in Conditional Access policies — untrusted device states trigger additional authentication challenges.

Endpoint encryption must extend to removable media — USB drives, external hard drives, and SD cards that leave the controlled environment. BitLocker To Go (Windows) encrypts removable drives using a password or smart card. macOS Disk Utility can create encrypted disk images. Enterprise DLP policies can be enforced at the OS level to require encryption on any USB storage device connected to corporate endpoints — unencrypted USB drives are blocked from receiving data. This prevents data loss when a USB drive is lost or stolen.

The security of full-disk encryption depends entirely on proper key management. Recovery keys must be stored securely and separately from the encrypted device — an organization that loses all copies of recovery keys has effectively lost access to their encrypted data permanently. Best practices: store BitLocker recovery keys in Active Directory / Azure AD automatically via Group Policy, back up FileVault recovery keys to MDM (Jamf/Intune), use Hardware Security Modules (HSMs) for enterprise key management at scale, and test recovery procedures quarterly.

Test your understanding of CompTIA Security+ (SY0-701) concepts from this lesson.

In this lesson you learned: TPM provides a hardware root of trust that seals encryption keys to specific boot states, Secure Boot verifies the cryptographic signature of every boot component to block bootkits, and BitLocker with TPM+PIN combines hardware key protection with pre-boot authentication to defend against both offline drive theft and evil-maid attacks. Next up we explore Business Continuity Planning and Disaster Recovery — ensuring operations survive major disruptions.