2.5 Safe Setup, Updates, and Power Management
Step 1: A Clean Install You Can Verify
Factory "recovery" images frequently ship with expired certificates, stale drivers, and vendor telemetry services baked in, so the first safe step is building from known media. Download the ISO directly from the vendor, verify its checksum against the published value (sha256sum ubuntu-24.04-desktop-amd64.iso), and write it to a USB stick you will erase afterwards. In UEFI setup, set an administrator password so an attacker with physical access cannot silently disable Secure Boot, enable Secure Boot and the TPM (PTT on Intel, fTPM on AMD), and remove unused boot devices so a malicious stick cannot simply be first in the boot order.
Step 2: Patch Everything, Including the Firmware
OS updates are the visible half. Run the full cycle once before daily use: Windows Update including optional driver updates, sudo apt update && sudo apt full-upgrade on Debian-family Linux, or a complete OS update on macOS and iOS, then confirm with Get-HotFix or uname -r. The invisible half is firmware: fwupdmgr get-devices and fwupdmgr update cover LVFS-listed UEFI, SSD, and dock firmware on Linux, and vendor tools cover the rest. Firmware matters because UEFI implants survive a clean install and re-format; vendor SPI updates are the only fix for such implants.
Step 3: Shrink the Protocol Surface
Enabled-but-unneeded services are the cheapest wins. On Windows servers and workstations run Set-SmbServerConfiguration -EnableSMB1Protocol $false, since SMBv1 is the EternalBlue-era attack path; disable LLMNR via the "Turn off multicast name resolution" policy and NetBIOS over TCP/IP to blunt Responder-style poisoning; drop NTLMv1, legacy TLS 1.0 and 1.1, WPS on the wireless side, and Telnet or FTP in favor of SSH. Remove OEM bloatware that ships a local service or scheduled task, for example with Get-AppxPackage and winget uninstall.
Step 4: Close the Sleep-State Gap
Full-disk encryption is only as strong as the moment it is unlocked. Enable it before the first real data lands: manage-bde -status for BitLocker with a TPM-plus-PIN protector, cryptsetup luksFormat for LUKS, or FileVault on Apple silicon. Now consider sleep: S3 and modern S0ix keep DRAM powered, so the volume master key sits in RAM and a Thunderbolt or PCIe DMA attack, or a cold-boot grab, can read plaintext off a "locked" laptop. Hibernate writes hiberfile.sys or the swap partition, which must live inside the encrypted volume, and Fast Startup (hybrid shutdown) writes that same partial-image file on every shutdown, so enforce powercfg /h /type full to avoid plaintext page fragments and require re-authentication on wake.
Architecture Diagram
Key Takeaways
- Install from checksum-verified media, then lock UEFI with an admin password plus Secure Boot and TPM enabled.
- Patch firmware, not just the OS: UEFI implants survive reformatting, so vendor firmware updates are mandatory.
- Disable SMBv1, LLMNR, NetBIOS, NTLMv1, legacy TLS, WPS, Telnet, and FTP to shrink the reachable surface.
- Encryption with RAM powered is only decoration: sleep and hibernation expose keys and plaintext pages.
- Keep hibernation and Fast Startup files inside the encrypted volume, use
powercfg /h /type full, and require re-authentication on wake.