Menu

TPM: Trusted Platform Module

August 19, 2024
by Kieran Jessup

Why TPM Modules Matter for Modern Cybersecurity

In an age where data breaches and firmware-level attacks are becoming the new normal, the Trusted Platform Module (TPM) stands as one of the most underappreciated defenders of system integrity.

A TPM is a hardware chip that securely stores cryptographic keys, certificates, and measurements of system state. When combined with technologies like BitLocker or Secure Boot, it ensures that data and credentials are only released when the system’s firmware and boot sequence are verified as trusted1.

Unlike software-based encryption, TPM-backed security is hardware-rooted, meaning even if an attacker steals your drive, the encryption keys remain inaccessible without the original hardware. TPMs also support measured boot, enabling organisations to detect tampering before the operating system even loads2.

For enterprises operating under frameworks like the Australian Government Information Security Manual (ISM), TPMs play a crucial role in achieving compliance with several controls related to data-at-rest encryption and platform integrity verification:

ISM Controls and TPM Implementation

How TPM technology supports data-at-rest encryption and platform integrity verification

ISM Control
Description
TPM Implementation
ISM-0459

Full disk encryption (or controlled partial encryption) is implemented for data at rest.

TPM binds encryption keys to hardware, ensuring keys cannot be extracted or used on other devices.

ISM-1080

Use ASD-Approved Cryptographic Algorithms (or high assurance crypto) when encrypting media.

TPM provides hardware-based cryptographic acceleration and secure key storage for approved algorithms.

ISM-0457

For OFFICIAL: Sensitive/PROTECTED media, use crypto that’s CC PP-evaluated.

TPM 2.0 provides Common Criteria evaluated cryptographic functions for protected data encryption.

ISM-0460

For SECRET/TOP SECRET media, use HACE (High Assurance Cryptographic Equipment).

TPM can be integrated with HACE solutions to provide hardware-backed key management and storage.

ISM-0507

Cryptographic key-management processes/procedures are developed, implemented and maintained.

TPM underpins secure key storage, sealing, and lifecycle management with hardware-based protection.

ISM-1745

Enable Early Launch Anti-Malware, Secure Boot, Trusted Boot and Measured Boot.

TPM enables Measured Boot by storing boot measurements and validating system integrity before OS load.

In short, a TPM doesn’t just protect your data, it protects the trustworthiness of the entire device through hardware-bound encryption and measured boot capabilities. This directly supports ISM’s requirements for data-at-rest protection and platform integrity verification, ensuring compliance with Australian Government security standards.


Footnotes

  1. Microsoft, Trusted Platform Module Technology Overview, Microsoft Learn, 2024.

  2. Australian Cyber Security Centre (ACSC), Windows Hardening Guide, v5.1, 2023.