Device Hardening

Guide covering device security with full-disk encryption and secure boot for comprehensive protection.

<h2>Full-Disk Encryption Implementation</h2>
<h3>Windows - BitLocker</h3>
<ul>
    <li><strong>Enable via Settings:</strong> Go to Settings → Update & Security → Device encryption.</li>
    <li><strong>BitLocker Management:</strong> Use BitLocker admin console for advanced options.</li>
    <li><strong>Recovery key:</strong> Save recovery key to Microsoft account or print it.</li>
    <li><strong>TPM integration:</strong> Use TPM chip for additional security layer.</li>
    <li><strong>Encryption method:</strong> Choose new encryption (recommended) or compatible mode.</li>
</ul>

<h3>macOS - FileVault</h3>
<ul>
    <li><strong>Enable in System Preferences:</strong> Security & Privacy → FileVault → Turn On.</li>
    <li><strong>iCloud recovery:</strong> Store recovery key in iCloud for account recovery.</li>
    <li><strong>Universal Recovery Key:</strong> Generate and print recovery key for offline access.</li>
    <li><strong>Startup security:</strong> Configure boot password in Security & Privacy settings.</li>
    <li><strong>External drives:</strong> Use disk utility to encrypt external drives.</li>
</ul>

<h3>Linux - LUKS</h3>
<ul>
    <li><strong>Install during setup:</strong> Choose encrypted partition during installation.</li>
    <li><strong>luksFormat:</strong> Encrypt existing partitions with cryptsetup luksFormat.</li>
    <li><strong>Multiple keyslots:</strong> Add multiple passwords or keys for flexibility.</li>
    <li><strong>Header backup:</strong> Regularly backup LUKS header with cryptsetup luksHeaderBackup.</li>
    <li><strong>Swap encryption:</strong> Encrypt swap space to prevent data leakage.</li>
</ul>

<h2>Secure Boot Technology</h2>
<p>Secure Boot prevents unauthorized firmware and operating systems from loading:</p>
<ul>
    <li><strong>UEFI Secure Boot:</strong> Verifies bootloader signatures before execution.</li>
    <li><strong>Measured Boot:</strong> Records boot process measurements in TPM for verification.</li>
    <li><strong>Kernel integrity:</strong> Ensures only signed kernels can boot.</li>
    <li><strong>Firmware protection:</strong> Prevents bootkit and rootkit installation.</li>
</ul>

<h3>Enabling Secure Boot</h3>
<ul>
    <li><strong>Windows:</strong> Enable in UEFI/BIOS settings; ensure TPM is active.</li>
    <li><strong>Linux:</strong> Most distributions support Secure Boot; enable in UEFI settings.</li>
    <li><strong>macOS:</strong> Secure Boot is enabled by default; configure in Recovery Mode.</li>
</ul>

<h2>TPM and Hardware Security</h2>
<h3>Trusted Platform Module (TPM)</h3>
<ul>
    <li><strong>Key storage:</strong> Securely store encryption keys and certificates.</li>
    <li><strong>Platform integrity:</strong> Measure and verify system integrity at boot.</li>
    <li><strong>Hardware-based crypto:</strong> Accelerate encryption operations.</li>
    <li><strong>Biometric integration:</strong> Store and protect biometric templates.</li>
</ul>

<h3>Security Considerations</h3>
<ul>
    <li><strong>TPM versions:</strong> TPM 2.0 provides stronger security than 1.2.</li>
    <li><strong>Physical access:</strong> TPM can be compromised with physical access.</li>
    <li><strong>Firmware updates:</strong> Keep TPM firmware updated to patch vulnerabilities.</li>
    <li><strong>Disabling TPM:</strong> Never disable TPM on production systems.</li>
</ul>

<h2>Advanced Hardening</h2>
<ul>
    <li><strong>BIOS/UEFI passwords:</strong> Prevent unauthorized boot configuration changes.</li>
    <li><strong>Boot order security:</strong> Disable booting from external media.</li>
    <li><strong>Hardware kill switches:</strong> Use devices with physical camera/microphone switches.</li>
    <li><strong>Peripheral security:</strong> Use USB data blockers to prevent data transfer.</li>
    <li><strong>Screen privacy filters:</strong> Prevent shoulder surfing in public.</li>
</ul>

<div class="quote">
    "Encryption protects your data at rest, but hardware security ensures the entire boot chain is trustworthy."
</div>

<a href="/guides/" class="back-link">← Back to Guides</a>