← Back to Articles

Hardware Configuration Standards: Building Security From the Ground Up

September 22, 2025•Configuration Management•4 min read

In 2023, a Fortune 500 company suffered a catastrophic breach that bypassed every software control in their stack. The entry point? A fleet of servers still running default BIOS passwords with Secure Boot disabled. Hardware configuration standards aren't glamorous, but they represent the bedrock upon which every other security control depends—and getting them wrong means your entire defense-in-depth strategy is built on sand.

Why Hardware Configuration Standards Matter

Hardware misconfigurations sit below the operating system, below your EDR, below your SIEM. They exist in a layer most security teams audit once during procurement and never revisit. Yet attackers increasingly target firmware and hardware-level settings because compromises at this layer are persistent, difficult to detect, and survive OS reinstallation.

Frameworks like CIS Benchmarks, NIST SP 800-53 (CM-6, CM-2), and DISA STIGs all mandate hardware configuration baselines. But mandating and implementing are very different things.

Establishing a Hardware Configuration Baseline

Every enterprise environment should maintain a Hardware Configuration Management Database (CMDB) that documents approved configurations for each device class. At minimum, your baseline should cover:

  • BIOS/UEFI settings (boot order, Secure Boot, TPM enablement)
  • Firmware versions and approved update cadences
  • Peripheral restrictions (USB ports, Thunderbolt DMA access)
  • CPU-level security features (Intel VT-x, AMD-V, SME/SEV)

Start by auditing your current state. On Linux systems, you can pull BIOS configuration details with:

# Dump UEFI Secure Boot status
mokutil --sb-state

# Enumerate firmware details
dmidecode -t bios

# Check TPM availability and version
cat /sys/class/tpm/tpm0/tpm_version_major

On Windows, PowerShell provides similar visibility:

# Confirm Secure Boot status
Confirm-SecureBootUEFI

# Query TPM information
Get-Tpm

# Check BIOS version against approved baseline
Get-WmiObject -Class Win32_BIOS | Select-Object SMBIOSBIOSVersion, ReleaseDate

BIOS/UEFI Hardening: The Non-Negotiables

Every hardware standard should enforce these settings without exception:

  1. Set and rotate BIOS passwords. Default passwords are publicly documented for every major vendor. Use a centralized management tool like Dell Command | Configure or HP BIOS Configuration Utility:
# Dell example: Set BIOS admin password via CCTK
cctk --setuppwd=Y0urC0mpl3xP@ss

# Enforce Secure Boot
cctk --secureboot=enable

# Disable USB boot
cctk --usbboot=disable

  1. Enable Secure Boot to prevent unsigned bootloaders from executing. This is your first defense against bootkits.

  2. Enable and provision the TPM 2.0 module. BitLocker, measured boot, and remote attestation all depend on it.

  3. Restrict boot order to internal drives only. Network boot (PXE) should be limited to provisioning VLANs with authentication.

Firmware Integrity and Update Management

Firmware vulnerabilities like LogoFAIL and BlackLotus proved that firmware is a first-class attack surface. Implement a firmware update policy that includes:

  • Automated firmware inventory scanning using tools like LVFS (Linux Vendor Firmware Service) or Microsoft Intune's DFCI profiles
  • Approved firmware hashes validated before deployment
  • Rollback protection to prevent firmware downgrade attacks
# Check for available firmware updates via fwupd (Linux)
fwupdmgr get-updates
fwupdmgr update

Peripheral and DMA Protection

Thunderbolt and USB ports are direct memory access vectors. Your hardware standard should enforce:

  • Kernel DMA Protection enabled in UEFI
  • USB device whitelisting via Group Policy or usbguard on Linux
# Install and configure USBGuard
sudo usbguard generate-policy > /etc/usbguard/rules.conf
sudo systemctl enable --now usbguard

Auditing and Continuous Compliance

Configuration standards are worthless without enforcement. Integrate hardware audits into your compliance pipeline:

  • Use SCAP-compliant scanners to validate BIOS/UEFI settings quarterly
  • Automate drift detection by comparing CMDB baselines against live telemetry
  • Flag any device that fails hardware attestation and quarantine it from production networks

Final Thoughts

Hardware configuration standards are the security layer nobody sees—until they fail. By codifying BIOS hardening, firmware integrity, and peripheral restrictions into enforceable policy, you eliminate an entire class of attacks that software controls simply cannot reach. Start with your baseline, automate your audits, and treat firmware with the same rigor you give your firewall rules.

Have questions about hardware configuration standards? I'm always happy to talk shop — reach out or connect with me on LinkedIn.

← Back to Articles