Security inspections

1 . A method for performing an out-of-band security inspection of a device, the method comprising:

generating a snapshot of a state of the device;

storing data representing the snapshot to a non-volatile storage of the device;

storing a hash of the snapshot in a basic input/output system (BIOS) of the device;

transitioning a power state of the device;

triggering boot of a trusted diskless operating system image;

providing the data representing the snapshot and the hash of the snapshot to the trusted diskless operating system image; and

executing a script selected based on a trigger event and the hash of the snapshot to analyze at least a portion of the non-volatile storage of the device.

2 . The method as claimed in claim 1 , further comprising:

executing a data collection process in response to the trigger event.

3 . The method as claimed in claim 1 , wherein the trigger event comprises one of a security detection or user intervention.

4 . The method as claimed in claim 1 , further comprising:

mounting the non-volatile storage of the device from the trusted diskless operating system image.

5 . The method as claimed in claim 1 , wherein transitioning the power state of the device comprises forcing a reboot of the device from a current state of operation of the device.

6 . The method as claimed in claim 1 , further comprising mounting the trusted diskless operating system image from a local storage location of the device, wherein the local storage location is separate from the non-volatile storage of the device.

7 . The method as claimed in claim 1 , further comprising communicating results of the analysis of at least the portion of the non-volatile storage of the device to an agent by way of data written to a disk and a second hash sent via the BIOS.

8 . A device, comprising:

a non-volatile storage;

a basic input/output system (BIOS); and

a processor to:

generate a snapshot of a state of the device;

store data representing the snapshot to the non-volatile storage;

store a hash of the snapshot in the BIOS;

transition a power state of the device;

trigger boot of a trusted diskless operating system image, the trusted diskless operating system image comprising a trusted diskless operating system;

provide the data representing the snapshot and the hash of the snapshot to the trusted diskless operating system; and

execute a script provided as part of the trusted diskless operating system to perform an out-of-band security inspection of at least a portion of the non-volatile storage.

9 . The device as claimed in claim 8 , wherein the processor is to transition the power state of the device in response to a trigger.

10 . The device as claimed in claim 8 , wherein the processor is to download the trusted diskless operating system image from a remote storage, the location of which is configured in the BIOS.

11 . The device as claimed in claim 8 , wherein the processor is to mount the trusted diskless operating system from a local storage location of the device, and wherein the local storage location is separate from the non-volatile storage of the device in which a main operating system of the device is installed.

12 . The device as claimed in claim 8 , wherein the processor is to execute a secure agent to download the trusted diskless operating system image from a remote location.

13 . The device as claimed in claim 12 , wherein the processor is to compare a hash of an expected trusted diskless operating system image with a hash of the trusted diskless operating system image retrieved from the remote location.

14 . A non-transitory machine-readable storage medium encoded with instructions executable by a processor of an apparatus to cause the apparatus to:

generate a snapshot of a state of the apparatus;

store data representing the snapshot to a non-volatile storage of the apparatus;

store a hash of the snapshot in a basic input/output system (BIOS) of the apparatus;

change an operational state of the apparatus;

trigger boot of a trusted diskless operating system image;

provide the data representing the snapshot and the hash of the snapshot to the trusted diskless operating system image; and

analyze at least a portion of the non-volatile storage of the apparatus based on information provided as part of a script that is provided as part of the trusted diskless operating system image.

15 . The non-transitory machine-readable storage medium as claimed in claim 14 , wherein the instructions are executable by the processor of the apparatus to cause the apparatus to:

download the trusted diskless operating system image from a remote location.

16 . The non-transitory machine-readable storage medium as claimed in claim 14 , wherein the instructions are executable by the processor of the apparatus to cause the apparatus to:

trigger the boot of the trusted diskless operating system image in response to a security event recognized by the BIOS.

17 . The non-transitory machine-readable storage medium as claimed in claim 16 , wherein the instructions are executable by the processor of the apparatus to cause the apparatus to:

execute the script to analyze at least the portion of the non-volatile storage of the apparatus based on the security event and the hash of the snapshot.

18 . The non-transitory machine-readable storage medium as claimed in claim 14 , wherein the instructions are executable by the processor of the apparatus to cause the apparatus to:

mount the non-volatile storage of the apparatus from the trusted diskless operating system image.

19 . The method as claimed in claim 1 , further comprising:

retrieving the trusted diskless operating system image from a remote location configured in the BIOS of the device.

20 . The device as claimed in claim 9 , wherein the processor is to select the script based on the trigger and the hash of the snapshot.