HP ProtectTools - Firmware security features in HP business notebooks

ManualsBrandsHP ManualsTabletHP Compaq tc4200 Tablet PC

HP ProtectTools

Firmware security features in HP business notebooks

Embedded Security Overview ............................................................................................................... 2

Basics of Protection .............................................................................................................................. 2

Protecting against unauthorized access – user authentication ....................................................................3

Pre-boot Authentication on HP Notebooks............................................................................................... 3

Power-on Password authentication overview........................................................................................ 4

Enabling Power-on password......................................................................................................... 4

Smart card authentication overview.................................................................................................... 4

Enabling smart card pre-boot authentication .................................................................................... 4

Embedded security chip pre-boot authentication overview..................................................................... 5

Enabling embedded security chip pre-boot user authentication .............................................................. 5

Protecting local storage ........................................................................................................................ 5

DriveLock hard drive protection ......................................................................................................... 6

TPM enhanced DriveLock .................................................................................................................. 6

Securing Devices ................................................................................................................................. 6

Boot Options ................................................................................................................................... 7

Device Control................................................................................................................................. 7

Accessing BIOS Security Features from Microsoft Windows ...................................................................... 7

Working with BIOS Configuration Profiles......................................................................................... 10

Enabling Profiles ............................................................................................................................ 10

Appendix ......................................................................................................................................... 11

For more information.......................................................................................................................... 12

Summary of content (12 pages)

PAGE 1
HP ProtectTools Firmware security features in HP business notebooks Embedded Security Overview ............................................................................................................... 2 Basics of Protection .............................................................................................................................. 2 Protecting against unauthorized access – user authentication ....................................................................
PAGE 2
Embedded Security Overview A computer system is only as secure as its weakest component. Creating a secure system involves looking at all areas of vulnerability and creating solutions to address those areas. HP ProtectTools does that by providing a solution for all points of vulnerability. These include: • Securing the device • Securing the network • Protecting the data Security solutions installed at the operating system (OS) level can provide a lot of protection against unauthorized access.
PAGE 3
Embedded Layers of Protection Protecting against unauthorized access – user authentication User authentication on current operating systems is password based. These operating systems authenticate users and grant access based on the correct entry of a user name and password. Externally, software tools can enhance this functionality to require devices other than passwords, such as hardware tokens and biometrics, but the underlying authentication is still password based.
PAGE 4
Power-on Password authentication overview Pre-boot power-on authentication is a simple but effective implementation of pre-boot security and has been available on computers for some time. In their simplest form, power-on passwords require a user to enter a password that gets stored in the system’s non-volatile memory. At power-on, the system prompts the user for the stored password and allows the boot process to continue if the correct password is entered.
PAGE 5
2. The BIOS password should be stored on the smart card. This is done via the HP ProtectTools smart card security module. To complete this step, select the BIOS tab on the smart card security module and enable smart card security. If the card has not already been initialized, HP ProtectTools smart card security will automatically walk the user through card initialization. Best Practice In order to use smart card pre-boot security, it is best to create both an administrator card and a user card.
PAGE 6
HP notebooks enable a hard drive security feature called DriveLock. DriveLock, if enabled, locks the hard drive with a password. At power-on, the user is prompted for the DriveLock password. The hard drive is accessible only after the correct DriveLock password is entered. DriveLock hard drive protection DriveLock is not another password that the user has to remember.
PAGE 7
2. Enable / Disable devices Boot Options Allows users the ability to control multiboot, which is the user’s ability to choose boot order. Boot order can be prioritized among the following devices: a. b. c. d. e. hard drive (primary, secondary) diskette drive optical drive USB storage devices (hard drive, diskette drive, optical drive) network The BIOS can provide finer control over the ability to boot by giving users the ability to enable/disable boot from the following devices: a. optical device b.
PAGE 8
BIOS configuration for HP ProtectTools With BIOS Configuration for HP ProtectTools, authorized users can: • Manage power-on user and administrator passwords • Configure pre-boot authentication features such as smart cards, power -on passwords, and DriveLock • Configure the ability to boot to devices other than the primary hard drive 8
PAGE 9
Table 1 -- BIOS Configuration for HP ProtectTools features and benefits Feature Benefit Works with HP ProtectTools Security Manager User interface is fully integrated into the HP ProtectTools Security Manager. Provides access to BIOS security and configuration features from within the operating system Provides an easier to use alternative to the pre-boot BIOS configuration utility known as (F10 Setup).
PAGE 10
Ties a hard drive to a specific system with a specific embedded security chip, preventing other systems from accessing the hard drive if it is physically removed from the original system. Smart card pre-boot authentication Requires a user to insert a smart card and, optionally, enter a PIN to authenticate prior to an operating system being allowed to load Protects a system from unauthorized access by requiring a user to insert their smart card to boot the system.
PAGE 11
Appendix The following table lists the BIOS security features mentioned in this whitepaper, and maps those features on to the supported notebook PC’s.
PAGE 12
For more information 1. HP ProtectTools Security Manager, Hewlett-Packard Company, 2004 2. HP ProtectTools Embedded Security – the HP Trusted Computing Implementation, Hewlett-Packard Company, October 2003. 3. HP Embedded Security for ProtectTools - Embedded Security Chip Pre-Boot User Authentication, Hewlett-Packard Company, January 2005. 4. HP ProtectTools Embedded Security – Expanding Trust Within the Enterprise Computing Environment, Hewlett-Packard Company, May 2003. 5.