Topic 2 · Deep Dive

2.5 Safe Setup, Updates, and Power Management

Step 1: A Clean Install You Can Verify

Factory "recovery" images frequently ship with expired certificates, stale drivers, and vendor telemetry services baked in, so the first safe step is building from known media. Download the ISO directly from the vendor, verify its checksum against the published value (sha256sum ubuntu-24.04-desktop-amd64.iso), and write it to a USB stick you will erase afterwards. In UEFI setup, set an administrator password so an attacker with physical access cannot silently disable Secure Boot, enable Secure Boot and the TPM (PTT on Intel, fTPM on AMD), and remove unused boot devices so a malicious stick cannot simply be first in the boot order.

Step 2: Patch Everything, Including the Firmware

OS updates are the visible half. Run the full cycle once before daily use: Windows Update including optional driver updates, sudo apt update && sudo apt full-upgrade on Debian-family Linux, or a complete OS update on macOS and iOS, then confirm with Get-HotFix or uname -r. The invisible half is firmware: fwupdmgr get-devices and fwupdmgr update cover LVFS-listed UEFI, SSD, and dock firmware on Linux, and vendor tools cover the rest. Firmware matters because UEFI implants survive a clean install and re-format; vendor SPI updates are the only fix for such implants.

Step 3: Shrink the Protocol Surface

Enabled-but-unneeded services are the cheapest wins. On Windows servers and workstations run Set-SmbServerConfiguration -EnableSMB1Protocol $false, since SMBv1 is the EternalBlue-era attack path; disable LLMNR via the "Turn off multicast name resolution" policy and NetBIOS over TCP/IP to blunt Responder-style poisoning; drop NTLMv1, legacy TLS 1.0 and 1.1, WPS on the wireless side, and Telnet or FTP in favor of SSH. Remove OEM bloatware that ships a local service or scheduled task, for example with Get-AppxPackage and winget uninstall.

Step 4: Close the Sleep-State Gap

Full-disk encryption is only as strong as the moment it is unlocked. Enable it before the first real data lands: manage-bde -status for BitLocker with a TPM-plus-PIN protector, cryptsetup luksFormat for LUKS, or FileVault on Apple silicon. Now consider sleep: S3 and modern S0ix keep DRAM powered, so the volume master key sits in RAM and a Thunderbolt or PCIe DMA attack, or a cold-boot grab, can read plaintext off a "locked" laptop. Hibernate writes hiberfile.sys or the swap partition, which must live inside the encrypted volume, and Fast Startup (hybrid shutdown) writes that same partial-image file on every shutdown, so enforce powercfg /h /type full to avoid plaintext page fragments and require re-authentication on wake.

Architecture Diagram

Setup timeline: build, patch, trim, lock clean install verified ISO apply patches UEFI + drivers disable legacy SMBv1 + LLMNR sleep-state disk lock wipe + UEFI boot OS + firmware NetBIOS off FDE + pre-boot PIN Fast Startup writes hiberfile.sys on every shutdown hiberfile.sys outside the encrypted volume = key gap
Posture is built in order: verified base, patches including firmware, a smaller protocol surface, then closing the sleep-state key-in-RAM gap.

Key Takeaways

« Back to Topic 2« 2.4