A security architect is designing hardware-level protections for unattended retail payment kiosks deployed in public environments. To protect payment encryption keys against physical memory extraction and ensure that only authenticated firmware executes during startup, which of the following hardware security controls should be implemented? (Select TWO.)
- Integrate a Cryptographic Co-processor equipped with active physical tamper detection and key zeroization capabilities.Answer
- Establish a hardware Root of Trust using a Trusted Platform Module to measure and validate each stage of the bootloader.Answer
- CDeploy network-level intrusion prevention firewalls directly at the edge controller to block memory bus extraction attacks.
- DImplement OS user-space asymmetric encryption libraries for high-speed bulk storage disk read and write operations.
Answer
The correct controls are integrating a Cryptographic Co-processor with active physical tamper detection and key zeroization, and establishing a hardware Root of Trust using a Trusted Platform Module to measure and validate boot phases.
Protecting unattended hardware requires physical and firmware-level controls. Active physical tamper detection circuitry automatically zeroizes stored cryptographic keys when physical intrusion occurs. Concurrently, a hardware Root of Trust combined with a Trusted Platform Module provides Measured Boot and Secure Boot verification to ensure that only digitally signed, verified firmware is loaded at boot time.
Step-by-Step Solution
Key Concept
Hardware-Based Root of Trust and Physical Tamper Resistance
Estimated Time:1m 30s