Computer Hardware Components

The previous course counted how many separate paths there are to reach an asset and measured each defense principle by the paths it closed. All of those paths shared one thing: every one of them passed through a machine. The machine itself was never opened up.

This lesson does not treat hardware as a catalog. How many cores the processor has or how fast the memory runs is not the question here. The question is: which boundary does a component draw, how many items sit on either side of that boundary, and what becomes reachable once the boundary is crossed.

Hardware as a List of Boundaries

A component’s security value is written with three numbers.

The boundary’s name and side. A component forces a distinction: one set of items sits inside, the rest outside. “The processor is secure” carries no decision; “the processor draws the privilege-mode boundary, and this many items sit inside that boundary” does.

The items required to cross the boundary. Crossing from one side to the other requires how many separate conditions to be wrong at the same time. This number is the isolation strength. If it is one, there is no boundary: a single fault grants the whole crossing. If it is zero, the boundary was never established.

The items reached when the boundary falls. The boundary is assumed crossed once, and how many items become reachable is counted. A narrow boundary yields few items even when it falls; a wide boundary opens the entire inventory when it falls.

The Boundary of Eight Components

The example is a branch server in the course’s fictional regional measurement network: it stores data arriving from the endpoints that collect meter readings and distributes it to field teams’ laptops. Both the server and the inventory are fictional; the table below is a model — there is no real machine, vendor, or configuration.

HO1: the protected asset inventory is 43 items, divided into seven layers. HO2: each component draws a boundary; the layers reached when the boundary falls are written item by item. HO3: the threshold is the number of items that must be simultaneously wrong to cross the boundary, given separately for remote access and physical access. HO4: there are four hardening settings; each adds two items to its component’s physical threshold. HO5: the boundary with the lowest threshold is selected; the items reached are the union of the layers opened by boundaries at a threshold of one or below. HO6: the peripheral interface cannot be crossed remotely — it requires physical attachment.

// it/component.mjs — component and boundary inventory of the fictional regional measurement
// network branch server (model): not a real machine, vendor, or configuration. No randomness.

// Asset inventory: seven layers, items per layer.
export const LAYER = { "kernel-memory": 5, "process-memory": 9, "disk-data": 11,
  "configuration": 6, "key-material": 3, "network-endpoint": 4, "log": 5 };
export const TOTAL = Object.values(LAYER).reduce((a, b) => a + b, 0);
const ALL = Object.keys(LAYER);

// Each component draws a boundary. r/p: items that must be simultaneously wrong to cross the
// boundary over remote and physical access (Infinity: that path cannot cross it). setting:
// hardening that adds items to the boundary; extra: items added to p when the setting is on.
// opens: layers reached when the boundary falls.
export const BOUNDARY = [
  { name: "processor", boundary: "privilege-mode", r: 2, p: 2, setting: null, extra: 0,
    opens: ["kernel-memory", "process-memory", "configuration", "log"] },
  { name: "memory-management-unit", boundary: "process-address-space", r: 2, p: 2,
    setting: null, extra: 0, opens: ["process-memory"] },
  { name: "persistent-storage", boundary: "filesystem-permission", r: 2, p: 0,
    setting: "disk-encryption", extra: 2, opens: ["disk-data", "configuration", "log"] },
  { name: "firmware", boundary: "boot-chain", r: 3, p: 1,
    setting: "secure-boot", extra: 2, opens: ALL },
  { name: "trusted-platform-module", boundary: "key-storage", r: 3, p: 3, setting: null,
    extra: 0, opens: ["key-material"] },
  { name: "network-interface", boundary: "listening-port", r: 1, p: 1, setting: null, extra: 0, opens: ["network-endpoint"] },
  { name: "peripheral-interface", boundary: "device-memory-access", r: Infinity, p: 1,
    setting: "device-address-isolation", extra: 2, opens: ["kernel-memory", "process-memory"] },
  { name: "out-of-band-management-interface", boundary: "management-network", r: 2, p: 1,
    setting: "management-network-segmentation", extra: 2, opens: ALL },
];

export const SETTING = ["secure-boot", "disk-encryption", "device-address-isolation",
  "management-network-segmentation"];

export const item = (layers) => layers.reduce((a, l) => a + LAYER[l], 0);
// Threshold: items needed to cross a boundary given the set of enabled settings.
export const threshold = (s, path, open) => (path === "r" ? s.r : s.p + (open.has(s.setting) ? s.extra : 0));

// Weakest link: lowest threshold, its boundaries, and the items opened by loose boundaries.
export function weakest(path, open = new Set()) {
  const e = BOUNDARY.map((s) => threshold(s, path, open));
  const min = Math.min(...e);
  const loose = BOUNDARY.filter((s, i) => e[i] <= 1);
  const union = new Set(loose.flatMap((s) => s.opens));
  return { min, minName: BOUNDARY.filter((s, i) => e[i] === min).map((s) => s.name).join(" "),
    loose: loose.length, opened: item([...union]) };
}

// it/measure.mjs — counts each component's boundary, threshold, and the items opened when the boundary falls.
import { LAYER, TOTAL, BOUNDARY, SETTING, item, threshold, weakest } from "./component.mjs";

const write = (g, ...s) => console.log(s.map((v, i) =>
  (g[i] < 0 ? String(v).padEnd(-g[i]) : String(v).padStart(g[i]))).join(""));
const tally = (n) => (n === Infinity ? "-" : n);

console.log(`asset inventory: ${TOTAL} items / ${Object.keys(LAYER).length} layers — ` +
  Object.entries(LAYER).map(([k, v]) => `${k} ${v}`).join(", "));

const A = [-34, -23, 9, 10, 8, 10];
console.log("\n1. boundary per component (inside: items reached when the boundary falls)");
write(A, "component", "boundary", "inside", "outside", "remote", "physical");
for (const s of BOUNDARY) {
  const i = item([...new Set(s.opens)]);
  write(A, s.name, s.boundary, i, TOTAL - i, tally(s.r), tally(s.p));
}

const B = [-12, -28, 9, 14, 9];
console.log("\n2. weakest link (with no hardening setting enabled)");
write(B, "path", "weakest component", "lowest", "threshold<=1", "opened");
for (const [ad, path] of [["remote", "r"], ["physical", "p"]]) {
  const z = weakest(path);
  write(B, ad, z.minName, z.min, z.loose, z.opened);
}

const C = [-35, 9, 14, 9];
console.log("\n3. as settings are enabled in sequence (physical access)");
write(C, "open setting", "lowest", "threshold<=1", "opened");
const open = new Set();
write(C, "(none)", weakest("p").min, weakest("p").loose, weakest("p").opened);
for (const a of SETTING) {
  open.add(a);
  const z = weakest("p", open);
  write(C, `+ ${a}`, z.min, z.loose, z.opened);
}

const D = [-43, 9];
console.log("\n4. threshold distribution (all settings enabled, physical access)");
const all = new Set(SETTING);
const dist = {};
for (const s of BOUNDARY) dist[threshold(s, "p", all)] = (dist[threshold(s, "p", all)] || 0) + 1;
write(D, "threshold (items)", "components");
for (const k of Object.keys(dist).sort()) write(D, k, dist[k]);
write(D, "components that open the entire inventory",
  BOUNDARY.filter((s) => item([...new Set(s.opens)]) === TOTAL).length);

asset inventory: 43 items / 7 layers — kernel-memory 5, process-memory 9, disk-data 11, configuration 6, key-material 3, network-endpoint 4, log 5

1. boundary per component (inside: items reached when the boundary falls)
component                         boundary                  inside   outside  remote  physical
processor                         privilege-mode                25        18       2         2
memory-management-unit            process-address-space          9        34       2         2
persistent-storage                filesystem-permission         22        21       2         0
firmware                          boot-chain                    43         0       3         1
trusted-platform-module           key-storage                    3        40       3         3
network-interface                 listening-port                 4        39       1         1
peripheral-interface              device-memory-access          14        29       -         1
out-of-band-management-interface  management-network            43         0       2         1

2. weakest link (with no hardening setting enabled)
path        weakest component              lowest  threshold<=1   opened
remote      network-interface                   1             1        4
physical    persistent-storage                  0             5       43

3. as settings are enabled in sequence (physical access)
open setting                          lowest  threshold<=1   opened
(none)                                     0             5       43
+ secure-boot                              0             4       43
+ disk-encryption                          1             3       43
+ device-address-isolation                 1             2       43
+ management-network-segmentation          1             1        4

4. threshold distribution (all settings enabled, physical access)
threshold (items)                          components
1                                                  1
2                                                  3
3                                                  4
components that open the entire inventory          2

The numbers belong to the measurement class; their inputs are HO1–HO6.

The Boundary Below Establishes the One Above

The inside column of the first table splits the components into two groups. When firmware or the out-of-band management interface falls, all 43 items open; their outside columns are zero. When the memory management unit falls, 9 items open; when the trusted platform module falls, 3.

The difference does not come from whether the component matters; it comes from its order. Firmware is the first code that runs when the machine powers on, and it loads every layer that runs after it. This chain is called the boot chain: firmware starts the boot loader, the loader starts the operating system kernel, and the kernel starts the user processes. The code that enforces the privilege-mode boundary and the code that checks filesystem permissions both sit in the upper links of this chain. If the first link of the chain is altered, none of the boundaries above it are established — because the thing that establishes the boundary has itself been altered.

Secure boot exists for exactly this reason: each link verifies the next one’s signature before loading it. The model’s secure-boot setting raises firmware’s physical threshold from 1 to 3; bypassing the signature requires the signature check to be disabled, the trusted key set to be replaced, and the change to persist.

The trusted platform module runs the opposite way. Its boundary is narrow — just 3 items, the key material. But its threshold is 3 for both remote and physical access, because the key never leaves the module; the module uses the key, it does not hand it over. A narrow, deep boundary serves a different purpose than a wide, shallow one: the first protects few items almost certainly, the second protects many items weakly. This difference is invisible unless the two numbers are written separately.

What Changes When the Threshold Is Two

The processor’s privilege-mode boundary and the memory management unit’s process-address-space boundary carry the same threshold in the model: 2. The number says two separate conditions must be wrong at the same time. For privilege mode these are the existence of an exploitable bug in kernel code and an open call path that reaches that bug; without either one, no crossing occurs. For process address space these are a process being able to write outside its own boundary and the location it writes to falling within another process’s map.

Raising the threshold to two makes crossing harder — but only if the two items are independent. If the same configuration item closes both, or the same privileged account can change both, the two items behave as one and the real threshold is 1. The model does not see this dependency: the threshold function counts items, it does not ask about the link between them.

This is the first place the boundary falls short. The threshold table gives an upper bound, not a lower one; writing that a boundary is “two items” says at most two items are required, not that two items must independently be wrong. The number is therefore never used alone; two questions accompany it. Are the counted items managed separately? Can a single authority change both at once? If the answer to the second question is yes, the number drops to one and the boundary no longer counts as a boundary.

The same limitation applies to the third column too. The layer model counts process-memory and key-material as separate items, but a key sits in process memory while it is in use; if the memory management unit’s boundary falls at that moment, the items opened are not 9 but 9 plus whatever key currently sits in memory. Dividing the inventory into layers makes counting possible; it hides time.

Physical Access Drives the Threshold to Zero

The second table reads the same inventory two ways. Over remote access the weakest boundary is the network interface: threshold 1, items opened 4. Over physical access the weakest boundary is persistent storage, and its threshold is 0.

Zero’s meaning is exact: no condition needs to be wrong. When an unencrypted storage device is removed and mounted on another machine, filesystem permissions are never even asked, because what enforces the permissions is not the disk itself but the operating system that mounts it. The permission bits sit on the disk as data; without a kernel that honors them, nothing is enforced. Disk encryption raises this threshold to 2: both the key and the secret that unlocks the key are required.

The dash in the peripheral interface’s remote column is the other side of the same distinction. A device’s direct memory access cannot be exercised remotely; but if a device can be physically attached to the machine, the threshold is 1, and kernel memory plus process memory — 14 items — open. When device address isolation is enabled, the address space a device can see is restricted and the threshold rises to 3.

The Weakest Link Is Counted

The third table gives this lesson’s decision-carrying number. The four hardening settings are enabled in sequence, and the items opened are read on each row: 43, 43, 43, 43, 4.

Even after three settings are enabled, the entire inventory over physical access is still open. The reason is in the last column: the threshold<=1 count drops from 5 to 4, 3, 2, but it never reaches zero, and one of the remaining loose boundaries is, every time, the out-of-band management interface, which opens 43 items. Enabling secure boot and disk encryption never touches that component. The items reached drop to 4 only once the fourth setting — management network segmentation — is enabled.

This is the numerical counterpart of layering not closing paths on its own. Three settings strengthened three separate boundaries, and all three did real work, but the measured result did not change; because what is measured is not the average of the boundaries but the items opened by the weakest one. A hardening sequence should start from the loose boundary that opens the most items — the model’s sequence did the opposite, and its cost was gaining nothing across three whole steps.

The fourth table gives the remaining reading. With all settings enabled, the threshold distribution is 1, 3, and 4 components: one component’s threshold is still 1. That component is the network interface, and the items it opens number 4 — a narrow boundary. Also, two of the eight components each open the entire inventory on their own; these two components are the items that must be counted first on every machine in the measurement network.

Summary

• A component’s security value is three numbers: the boundary’s name and side, the number of items that must be simultaneously wrong to cross it, and the number of items reached when it falls.
• Across the 43-item inventory, the items opened by the eight components range from 3 to 43; firmware and the out-of-band management interface each open the entire inventory alone, because both sit beneath the boot chain or the management path.
• Over remote access the lowest threshold is 1 and opens 4 items; over physical access the lowest threshold is 0 and opens 43 items. On unencrypted storage, the filesystem permission is not a boundary but data sitting on the disk.
• A narrow, deep boundary (trusted platform module: 3 items, threshold 3) and a wide, shallow boundary (persistent storage: 22 items, threshold 0) can only be told apart in the same table if the two numbers are written separately.
• The threshold number assumes the items are independent. If the same authority or the same configuration item can change both, a two-item boundary is in fact a one-item boundary; the table gives an upper bound, not a lower one.
• Even after three of four settings are enabled, the items opened stay at 43; the number drops to 4 only once the loose boundary that opens the most items is closed. What is measured is not the average of the boundaries but the weakest one.

Next Step

The boundaries hardware draws have been counted, and two of them were seen to open the entire inventory. But hardware only makes possible most of the boundaries in the first table; the code that decides which request passes through does not live in hardware. The processor offers privilege mode, but the operating system chooses which process runs in it; the disk stores the filesystem permission, but the operating system is again what honors that permission.

The next lesson descends into this decision layer and asks a single question: running on the same hardware, how many items apart do different operating system families answer the same access request.