HP Pro SFF 280 G9 Desktop PC Maintenance and Service Guide - Page 74

Sure Start Secure Boot Keys Protection: Saves a backup copy of Secure Boot Keys so that they can

Page 74 highlights

Table 6-2 Computer Setup Security (continued) Option Description Security Configuration TPM Embedded Security ● TPM Specification Version Displays the current Trusted Platform Module (TPM) version. ● TPM Device Lets you set the TPM as available or hidden. Default is available. ● TPM State Select to enable the TPM. Default is disabled. ● Clear TPM Select to reset the TPM to an unowned state. After the TPM is cleared, it is also turned off. To temporarily suspend TPM operations, turn the TPM off instead of clearing it. Default is no. IMPORTANT: Clearing the TPM resets it to factory defaults and turns it off. You will lose all created keys and data protected by those keys. ● TPM Activation Policy ○ F1 to boot ○ Allow user to reject (default) ○ No prompts BIOS Sure Start ● Verify Boot Block on every boot: Select to enable HP Sure Start. Default is disabled. ● BIOS Data Recovery Policy: Select Automatic or Manual to determine data recovery process. Manual recovery is intended only for situations when you want forensic analysis before HP Sure Start recovery. When this policy is set to manual, HP Sure Start will not correct any issues that are found until the local user enters the manual recovery key sequence. This can result in a computer that cannot boot until the manual recovery key sequence is entered. ● Network Controller Configuration Restore: Select to restore the network controller parameters to the factory state saved in the HP Sure Start Private nonvolatile (flash) memory. This setting is available only on computers with built-in NIC. NOTE: This process can take up to 30 seconds. You need to restore this only when the Network Controller Configuration mismatch warning is set. ● Dynamic Runtime Scanning of Boot Block: Verifies the integrity of the BIOS boot block region several times each hour while the computer is running. Default is enabled. ● Sure Start BIOS Settings Protection: When enabled, HP Sure Start locks all critical BIOS settings and provides enhanced protection for these settings using nonvolatile (flash) memory. Default is off. NOTE: An administrator password must be set to activate this setting. ● Sure Start Secure Boot Keys Protection: Saves a backup copy of Secure Boot Keys so that they can be recovered if someone attempts to alter them in an unauthorized manner. ● Enhanced HP Firmware Runtime Intrusion Prevention and Detection: Enables monitoring of HP system firmware executing out of main memory while the operating system is running. Any anomalies detected in HP system firmware that is active while the operating system is running will result in a Sure Start security event being generated. ● Sure Start Security Event Policy. Controls HP Sure Start behavior upon identifying a critical security event, such as any modification to HP firmware, while the operating system is running. - Log Event Only: HP Sure Start will log all critical security events in the HP Sure Start audio log within the HP Sure Start nonvolatile (flash) memory. - Log Event and notify user: In addition to logging all critical sCeocmuriptyuetveernStse, tHuPpSuSreecSutarrittywill 67 notify the user within the operating system that a critical event has occurred. - Log Event and power off system: In addition to logging all critical security events, HP Sure Start turns off the computer upon detecting a HP Sure Start Security Event. Because of the potential

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116

Table 6-2
Computer Setup Security
(continued)
Option
Description
Security Configuration
TPM Embedded Security
TPM Specification Version
Displays the current Trusted Platform Module (TPM) version.
TPM Device
Lets you set the TPM as available or hidden. Default is available.
TPM State
Select to enable the TPM. Default is disabled.
Clear TPM
Select to reset the TPM to an unowned state. After the TPM is cleared, it is also turned off. To
temporarily suspend TPM operations, turn the TPM off instead of clearing it. Default is no.
IMPORTANT:
Clearing the TPM resets it to factory defaults and turns it off. You will lose all created
keys and data protected by those keys.
TPM Activation Policy
F1 to boot
Allow user to reject (default)
No prompts
BIOS Sure Start
Verify Boot Block on every boot: Select to enable HP Sure Start. Default is disabled.
BIOS Data Recovery Policy: Select Automatic or Manual to determine data recovery process. Manual
recovery is intended only for situations when you want forensic analysis before HP Sure Start
recovery. When this policy is set to manual, HP Sure Start will not correct any issues that are found
until the local user enters the manual recovery key sequence. This can result in a computer that
cannot boot until the manual recovery key sequence is entered.
Network Controller Configuration Restore: Select to restore the network controller parameters to the
factory state saved in the HP Sure Start Private nonvolatile (flash) memory. This setting is available
only on computers with built-in NIC.
NOTE:
This process can take up to 30 seconds. You need to restore this only when the Network
Controller Configuration mismatch warning is set.
Dynamic Runtime Scanning of Boot Block: Verifies the integrity of the BIOS boot block region several
times each hour while the computer is running. Default is enabled.
Sure Start BIOS Settings Protection: When enabled, HP Sure Start locks all critical BIOS settings and
provides enhanced protection for these settings using nonvolatile (flash) memory. Default is off.
NOTE:
An administrator password must be set to activate this setting.
Sure Start Secure Boot Keys Protection: Saves a backup copy of Secure Boot Keys so that they can be
recovered if someone attempts to alter them in an unauthorized manner.
Enhanced HP Firmware Runtime Intrusion Prevention and Detection: Enables monitoring of HP
system firmware executing out of main memory while the operating system is running. Any
anomalies detected in HP system firmware that is active while the operating system is running
will result in a Sure Start security event being generated.
Sure Start Security Event Policy. Controls HP Sure Start behavior upon identifying a critical security
event, such as any modification to HP firmware, while the operating system is running.
Log Event Only: HP Sure Start will log all critical security events in the HP Sure Start audio log
within the HP Sure Start nonvolatile (flash) memory.
Log Event and notify user: In addition to logging all critical security events, HP Sure Start will
notify the user within the operating system that a critical event has occurred.
Log Event and power off system: In addition to logging all critical security events, HP Sure Start
turns off the computer upon detecting a HP Sure Start Security Event. Because of the potential
Computer Setup Security
67