CySA+
  • Introduction
  • Exam Objectives
    • Quiz
      • Threat and Vulnerability Management Competency
        • Questions
  • 1.0 Threat and Vulnerability Management
    • 1.1 Explain the importance of threat data and intelligence
      • Page 1
      • Intelligence Sources
      • Confidence Levels
      • Indicator Management
        • Trusted Automated eXchange of Indicator Information (TAXII)
        • OpenIoC
      • Threat classification
        • Known threat vs. unknown threat
        • Zero-day
        • Advanced persistent threat
      • Open-source intelligence
      • Proprietary / closed-source intelligence
      • Timeliness, Relevancy, Accuracy
    • 1.2 Given a scenario, utilise threat intelligence to support organisational security
    • 1.3 Given a scenario, perform vulnerability management activities
    • 1.4 Given a scenario, analyse the output from common vulnerability assessment tools
    • 1.5 Explain the threats and vulnerabilities associated with specialised technology
    • 1.6 Explain the threats and vulnerabilities associated with operating in the cloud
    • 1.7 Given a scenario, implement controls to mitigate attacks and software vulnerabilities
  • 2.0 Software and Systems Security
    • 2.2 Explain software assurance best practices
    • 2.1 Given a scenario, apply security solutions for infrastructure management
    • 2.3 Explain hardware assurance best practices
Powered by GitBook
On this page
  1. 2.0 Software and Systems Security

2.3 Explain hardware assurance best practices

  • Hardware root of trust:

  • TPM: generates/stores cryptographic keys; full disk encryption; keeps hardware locked until authentication is complete; motherboard-embedded chip

  • HSM: manage/generate/store cryptographic keys; removeable/external device

  • eFuse: manufacturer can change circuits on a chip while it is in operation

  • UEFI: secure boot (only signed apps used at boot; OS needs recognised key to boot)

  • Trusted foundry: DoD program to secure supply chain of hardware for military

  • Secure processing:

    • Trusted execution: assures OS trust using TPM; prevents system/BIOS code corruption or platform configuration modification from stealing sensitive data (Intel)

    • Secure enclave: separately booted microkernel to store private decryption keys; apps never have direct access to the keys (Apple)

    • Processor security extensions: core can switch to secure state (only trusted code can run; can access secure memory; strict security state entry control) (ARM)

    • Atomic execution: cannot be interrupted by other threads; thread locking; shared data is always valid => thread safety

  • Anti-tamper: unusual screws/bolts; secure cryptoprocessors; zeroise when tampered; chips can't be accessed externally; fracture when interfered

  • Self-encrypting drive: user password to decrypt media; encrypt as data is written and decrypt as data is retrieved; encryption is invisible to user (can't be turned off)

  • Trusted firmware updates: copy images from non-secure to secure memory; image identification/authentication (Intel)

  • Measured boot and attestation: object signature hashes are recorded in TPM (measured boot); host reliably authenticates hardware/software config to remote server to determine level of trust in platform (remote attestation)

  • Bus encryption: encrypted instructions in data bus; executed by cryptoprocessor

Previous2.1 Given a scenario, apply security solutions for infrastructure management

Last updated 2 years ago