Hardware Failure and Security: What Can Go Wrong?

Hardware failures are not always security incidents, but they can still affect security goals.

A failed drive can destroy availability. A damaged memory module can corrupt data. An untrusted peripheral can create an unexpected input path. A stolen laptop can create a confidentiality problem even if the software was working perfectly.

The useful question is:

How does the component failure change what the system can protect or provide?

Availability failures

Examples:

• storage device fails
• power supply fails
• cooling failure shuts the system down
• network interface stops communicating
• RAM errors crash applications

Availability is not only about attacks. Reliability and recovery are part of secure system design.

Integrity failures

Examples:

• corrupted storage changes files
• memory errors alter active data
• failing hardware produces inconsistent sensor readings
• unstable power interrupts writes

A system can be available and still produce untrustworthy results.

Confidentiality failures

Examples:

• discarded storage still contains readable information
• a stolen device exposes unencrypted files
• a screen displays sensitive information where others can see it
• an unauthorized peripheral captures input

Physical access and data handling matter.

Build a fault tree

Choose one scenario:

A classroom workstation will not boot before an important presentation.

Start with the top event:

workstation unavailable

Branch into possible causes:

• power
• storage
• memory
• operating system
• display
• configuration

Then identify which observations would help distinguish them.

Do not call every failure a cyberattack.

Security versus reliability

A reliable system is not automatically secure.

A secure system is not useful if it cannot perform its required function.

Examples:

• full-disk encryption can protect a stolen laptop, but recovery keys must be managed
• backups improve recovery, but backup copies also need confidentiality and integrity protection
• locking every external port may reduce exposure but can interfere with legitimate classroom hardware

Security design has to preserve the system's mission.

Component risk review

Use a fictional school workstation inventory:

• laptop with SSD
• 8 GB RAM
• integrated camera/microphone
• USB ports
• Wi-Fi adapter
• external display
• cloud-backed project folder

For each item, identify:

• normal purpose
• one failure condition
• security impact
• one preventive or protective control
• one recovery control

Hardware lifecycle

Security continues when hardware is replaced.

Ask:

• What happens to old storage?
• Are accounts removed?
• Is the device reset?
• Are recovery keys or configuration secrets retained appropriately?
• Can the new device restore needed data?

A device leaving service can still contain information worth protecting.

Evidence for Lesson 2

Submit:

• workstation fault tree
• component risk review
• hardware lifecycle checklist
• one paragraph distinguishing reliability failure from evidence of attack

Finish with:

A hardware problem becomes a security problem when it affects ________.