Knowledge is Power

Sitewide Search

Search Bare Metal Cyber

Search courses, individual lessons, wiki entries, books, podcasts, magazine articles, Daily Cyber News, and Darwin.

MITRE D3FEND™ Learning Center

D3-TBI — TPM Boot Integrity

Assuring the integrity of a platform by demonstrating that the boot process starts from a trusted combination of hardware and software and continues until the operating system has fully booted and applications are running. Sometimes called Static Root of Trust Measurement (STRM).

1Mitigation mapping
1Parent technique
3Source references

Harden · D3FEND ontology 1.6.0 · Active

Open official technique ↗
Official D3FEND definition

Definition

Assuring the integrity of a platform by demonstrating that the boot process starts from a trusted combination of hardware and software and continues until the operating system has fully booted and applications are running. Sometimes called Static Root of Trust Measurement (STRM).

Official D3FEND knowledge-base content

How it works

During the boot process, the BIOS boot block (which with this defense enabled, is the Core Root of Trust for Measurement) measures boot components (firmware, ROM). The TPM hashes those measurements and stores the hashes in Platform Configuration Registers (PCRs). Upon a subsequent boot, these hashes are provided to a verifier which compares the stored measurements to the new boot measurements. Integrity of the boot components is assured if they match.

Attestation of the secure boot occurs when a verifying entity requests a Quote which is a concatenation of the requested PCR values, hashed and signed by the TPM's unique RSA key. The TPM signature is trusted because the private key is stored securely in hardware and never leaves the TPM.

Considerations

  • The TPM does not perform the follow-on actions of acting on the PCR value information, it just provides the PCR stored information.
  • The current version of TPM is 2.0.; most existing implementations use TPM 1.2.

Citations

[1] [TPM 2.0 Library](https://trustedcomputinggroup.org/resource/tpm-library-specification/) [2] [TCG Trusted Attestation Protocol (TAP) Use Cases for TPM Families 1.2 and 2.0 and DICE](https://trustedcomputinggroup.org/wp-content/uploads/TCG_TNC_TAP_Use_Cases_v1r0p35_published.pdf)

Bare Metal Cyber interpretation

Implementation perspective

TPM Boot Integrity should be treated as a technical defensive capability rather than a product checkbox. In practice, teams should define the protected scope, the conditions under which the technique acts, and the observable evidence that demonstrates the intended behavior. For this technique, likely engineering context includes the relevant system, activity, and evidence sources.

Use the technique to increase the effort, prerequisites, or constraints an adversary must overcome before exploitation or misuse succeeds.

Questions to ask

  • Which component, configuration, credential, interface, or behavior is being hardened?
  • What secure baseline or policy defines the intended state?
  • How are exceptions approved, time-limited, and reviewed?
  • How is the hardened state verified after deployment and significant change?

Evidence and validation

  • Approved hardening standards and configuration baselines
  • Automated configuration or integrity assessment results
  • Exception records with owners, rationale, and expiration dates
  • Test results demonstrating that the intended restriction is enforced

Common failure patterns

  • A secure setting is documented but not enforced consistently across the environment.
  • Hardening breaks required functions and is permanently weakened through undocumented exceptions.
  • Teams measure deployment of a product rather than verification of the hardened condition.

This implementation perspective is original Bare Metal Cyber educational content. It does not replace the official D3FEND definition or establish that a specific product implements the technique.

Ontology hierarchy

Technique hierarchy

Top-level family

Parent techniques

Direct child techniques

None listed at this level.

Curated D3FEND mapping

ATT&CK Enterprise mitigation relationships

These links come from the D3FEND ontology’s ATT&CK mitigation mapping. They help users navigate between the knowledge bases and do not guarantee mitigation effectiveness.

Source record

Authoritative sources