Time
3 hours 35 minutes
Difficulty
Intermediate
CEU/CPE
4

Video Transcription

00:00
hello and welcome to P C Security Intermediate course.
00:04
And in this lesson, I will be talking about protection of PC Harder meaning the,
00:10
uh pc Firmer. So I'm going to talk about how to protect you if I and I'm going to talk about confirming que if identity. So when we talk of protecting you, if I we have to approach is one is prevention, the other is detection.
00:27
And because we talk about about computer viruses, we used term virus, which is biological term from from the
00:37
real world, and so viruses are there to infect the device and then replicate.
00:47
And when we talk about fighting, the
00:51
the pathogens in biological terms we have to approach is one is a septic and the other is antiseptic, so a septic means be. Prevent the infection by making sure that
01:07
the environment is not infected. So during viruses around or bacteria's
01:12
and the other is antiseptic. Where we act with agents in orderto kill, the possible eight infected. It's
01:25
in PC World. In the year five World prevention means that you don't let your when you talk about you. If I we don't let the you If I get infected and we detection. We
01:41
detect that it's it's been compromised, and then we take steps to immediate the problem.
01:48
So they're two different approaches,
01:51
and I will give you the examples of these two approaches.
01:55
And this is when their specific So this one is done by HB and the way they doing things, they call it the market. It is HB short start bias,
02:07
but it's actually much more than bias. So they have a harbor protection off buyer. So they say, Okay, we cannot have software protection off software things,
02:16
because if suffered gets
02:20
manipulated, then the protection is down. So they have a tripped on the mother board physical chip that is proprietary, unique for for this manufacturer.
02:30
And it does several functions in the beginning that was doing one simple thing, which is
02:38
on the boot
02:39
when you when you buy your PC, it has, uh, what's called the golden copy of biasing store there,
02:47
and when you boot checks, the buyers that you have in that is booting up
02:53
that is supposed to boot up with your with your PC. So it physically holds this this phase between fervor. Frommer's being loaded into into components and boots off the bias
03:07
and checks it. And if it's ah, matching, then everything goes on. And if these two copies are not identical, then it simply really rights
03:20
the
03:22
ah Golden copy over the working copy and then rebuilds the machine again.
03:28
So it's very simple.
03:30
So if somebody has tempered with the bias,
03:34
then you have the way to really storage to the last original known state. And don't let it interfere with the machine that's being influenced by this change.
03:52
Um,
03:53
the next step that the next thing that this harder trip does is to detect riel time in real time, the possibilities of somebody trying to write something in the bias.
04:08
And then it sends some kind off message to the operating system, which can be really toe administrator. It can even block the function off operating system, basically freezes your PC
04:21
and, uh,
04:24
these things they have actually added to this a little bit more, because now they can also monitored from from buyers. They can monitor
04:33
the some some crucial security processes within the operating system, so if they're compromised, they or stop today restart.
04:43
So this is this is the whole concept off that is essentially prevention. So you say Okay, I have, ah have
04:53
safe bias. And if the other is not identical, then I will rewrite it.
05:00
This thing has some downsides. 1st 1 it really complicates by sub dates because then you have to somehow
05:08
in very secure way disabled dysfunction off checking. Because if you flush the bias with the new one, which is completely legit, which comes from the BC Men official So H B. In this case,
05:19
you have to tell somehow to this trip that
05:24
it should stop the whole
05:27
checking on boots
05:29
and actually allow this golden copy be rewritten with the new one.
05:33
And it requires more than one restart. During bias of the process. It can take up to 20 minutes.
05:44
So it's, um it's a thing, and this thing cannot be initiated from USB drive. It has to be done from the application that has keys that unlock these features. It has to be initiated from operating system, at least as far as I know. Maybe
06:02
maybe there are some new things in which we sure start. But this is essentially the way it's done,
06:08
of course, because there is additional piece of hardware and the mother board. It slightly increases the unit price, and because of that, it's not available on low end business PC. So these air downsides of this approach
06:19
the example of detection approaches, something that Dell is doing,
06:24
and what they do is they install a piece off a piece of software on your PC,
06:30
and it compares buys on a PC to hash off the last known correct version of PC, actually off every version off bias,
06:40
which is stored in del service. So if you need to have access to Internet at the moment when the Checker checking is happening
06:49
and the bias doesn't pass this trick process,
06:54
then they and notify administrator
06:58
and then you need to manually restore by us toe last known correct state. So you have to do manual reflects. So what?
07:09
The procedure is from this point, pretty much the same. Like what HB is doing, only it has to be initiated. Administrator.
07:17
The solution is almost foolproof, but it's not 100% foolproof, but it's huge.
07:24
Um, it's advantage towards,
07:29
uh, but was previously being on most of vendors machines, which was nothing.
07:33
Also in this way the administrator can or less a human being can have some insight in the validity of buyers off,
07:46
off PC, unlike the HP solution, which you just simply trust that this process is foolproof,
07:56
and so far it has been proven full full, so there is no need the reason not to trust it, just
08:01
in this case, some kind. Some help buddy who is administrator. If they're vigilant enough, they know what's happening, or they can have incited what's happening.
08:13
So what are the downsides? It's not automatic recovery. Somebody has to initiate it, and it's has spread to the entire network than can be a problem.
08:24
And this after a solution. And this is why it's not 100% proof foolproof. If somebody finds the way to temper with this this piece of software, I'm just just to do one simple thing to make sure that it gives the
08:37
clean bill of health to buy us every time, regardless of what you have done, then you have a problem because then your system is failing.
08:46
Okay, so there is 1 13 that people confused with protection of buyers, which is called Microsoft Secure Boot, and it's a feature in your if I bios, which Microsoft is pushing toe vendors
08:58
in order to have Windows compatible. Stamp on their PC's understand compatible. So you have, Ah, Microsoft difficult that is stored in your five and basically what you, if I does, is checks the book loader
09:16
before it's launching it. Remember the sequence. You have the Windows Book flow there
09:22
and to wear five. It's signed by Microsoft. So if it's not,
09:26
then if I won't allow the PC to boot, so say okay, but Loader is compromised and it won't boot.
09:35
Uh, the windows.
09:37
What is not doing isn't it's not preventing you if I from being changed. So this is very important thing.
09:43
This is just making sure between those book loader will load the boot the windows in the correct way. And it's not booting something that it's not Windows, but something else. So,
09:54
um, this is also with this feature you were having a little bit more problem toe. Have dual boot, for example. If you want to have Lennox on the same machine,
10:05
it's a little bit more difficult to do it, but it can be done so it's not fully preventing Lennox from living on the same machine. It just makes the life for the whoever has to make it work a little bit more difficult.
10:18
So essential downside of this this is
10:22
it's not actually preventing you if I for being changed. So if somebody wants to add something to unify, which has nothing to do with the Windows bulk loader,
10:31
But you had some low level functionality like a backdoor into into the PC on a low level below operating system, it can still do it, and this is secure. Boot function will not
10:43
prevent any of it.
10:46
Okay, So
10:48
just to check, if you have been listening carefully, what is Microsoft's secure but not preventing? Is it prevent not preventing bags or packages
10:58
or the placing of the boot loader or tempering with the boot loader?
11:03
And you have? If you have listened carefully, you know that it's not preventing Bystrov packages.
11:09
So it just preventing from tempering off Windows boot loader.
11:18
In this video, you learned about ways to establish trust in harder. So you learned about prevention and detection approach, and well, you have also learned about Microsoft secure boot. So
11:33
all these three things are very important in protecting your
11:39
physical hardware and in next lesson, I will continue talking about these things for some other components of PC.

Up Next

Intermediate PC Security

The Intermediate PC Security course will teach students about endpoint protection. Students will learn fundamental information about PC Security and common attack vectors.

Instructed By

Instructor Profile Image
Milan Cetic
IT Security Consultant
Instructor