BIOS-enabled security features in HP business notebooks - Technical white paper

ManualsBrandsHP ManualsDesktopsHP ProBook 4520s Notebook PC

Technical white paper

BIOS-enabled security features in HP business

notebooks

Table of contents

Basics of security protection 2

Protection against unauthorized access 2

Preboot authentication using BIOS 2

Forgotten passwords 5

Protecting local storage 5

DriveLock hard drive protection 6

Default settings for DriveLock and

Automatic DriveLock 6

HP Disk Sanitizer and Secure Erase 6

How does Disk Sanitizer work? 6

How does Secure Erase work? 7

Securing devices 7

Boot options 7

Device control 8

For more information 9

Summary of content (9 pages)

PAGE 1
Technical white paper BIOS-enabled security features in HP business notebooks Table of contents Basics of security protection 2 Protection against unauthorized access Preboot authentication using BIOS Forgotten passwords 2 2 5 Protecting local storage DriveLock hard drive protection Default settings for DriveLock and Automatic DriveLock Automatic DriveLock HP Disk Sanitizer and Secure Erase How does Disk Sanitizer work? How does Secure Erase work? 5 6 Securing devices Boot options Device control 7 7
PAGE 2
Basics of security protection A computer system is only as secure as its weakest component. Creating a secure system involves looking at all areas of vulnerability and creating solutions to address each of those areas. A typical computer system stores sensitive data on a local hard drive and may have access to network resources containing sensitive information.
PAGE 3
Multiuser architecture in BIOS Multiuser architecture relies on role-based user groups. The BIOS can separate functions and access among these different user groups. The separation promotes higher security in the following ways:  Users no longer need to share passwords.  BIOS administrators do not have to share setup passwords with users.  BIOS administrators can assign granular control of setup features to users. Currently the BIOS defines two user types.
PAGE 4
 HP Credential Manager—Protects the Windows account. The ProtectTools user can select security levels, as well as the type of security authentication required at each security level. Either a Windows password or a fingerprint can be used for authentication. NOTE: Fingerprint authentication can be enabled only through the ProtectTools software. ProtectTools user privileges include the following:  Using the Windows password and other security tokens to authenticate and boot the BIOS.
PAGE 5
To set up the fingerprint reader, review the ProtectTools user guide at http://h10032.www1.hp.com/ctg/Manual/c02292692.pdf. Use HP ProtectTools Administrative Console to modify the logon policy, credential requirements, or other management settings that have been configured in the Security Manager setup wizard.
PAGE 6
DriveLock hard drive protection A hard drive protected with a DriveLock password stays protected, even if the drive is removed from one system and inserted into another. At power-on, the system prompts the user for the DriveLock password. If an incorrect password is entered, the information on the hard drive is inaccessible. The DriveLock password is stored inside the hard drive itself and cannot be read; it can only be authenticated against.
PAGE 7
Table 1: Data written to the drive on each cycle Disk Sanitizer cycle Data written to drive First cycle 00000000 (all zeros) Second cycle 11111111 (all ones) Third cycle random writes of 1 or 0 and verify Fourth cycle 00000000 (all zeros) Enabling Disk Sanitizer Access Disk Sanitizer by pressing the f10 key as the system starts. Select Disk Sanitizer from the Security Menu.
PAGE 8
 Upgrade Bay Hard Drive (A hard disk inserted in the optical drive bay) To access the boot options, boot the system, and enter the f10 BIOS setup. Select Boot Options from the System Configuration menu, and then select the devices to enable or disable. Unless it is routinely necessary to boot from devices other than the primary hard drive, disable all other boot capabilities. The user can also choose the boot order of enabled devices. 1. 2. Boot the system, and press f10 to enter the BIOS setup.
PAGE 9
 USB ports  Smart Card  eSATA For more information To read more about HP ProtectTools, go to http://h20331.www2.hp.com/hpsub/cache/281822-0-0-225-121.html. Related papers: HP Business Notebook PC F10 Setup Overview http://bizsupport1.austin.hp.com/bc/docs/support/SupportManual/c02950079/c02950079.pdf HP Business Notebook Password Localization Guidelines http://bizsupport1.austin.hp.com/bc/docs/support/SupportManual/c01944819/c01944819.pdf HP ProtectTools User Guide http://h10032.www1.hp.