Configuring basic input output system (BIOS) features based on a policy
In some examples, a computing device may receive (i) settings associated with one or more features of a basic input output system (BIOS) of the computing device and (ii) a device identifier that uniquely identifies the computing device. The computing device may determine a policy identifier that identifies a policy being implemented by the settings associated with the one or more features of the BIOS. The computing device may retrieve a public key associated with an organization that acquired the computing device and sending a request to a service to validate the policy. The request may include the policy identifier and the public key. After the computing device receives a response from the service indicating that the policy is valid, the computing device may initiate a reboot and modify, during the reboot, the one or more features of the BIOS of the computing device based on the settings.
1. A method comprising:
receiving, by one or more processors of a computing device, settings associated with one or more features of a basic input output system (BIOS) of the computing device;
receiving, by the one or more processors, a device identifier that uniquely identifies the computing device;
determining, by the one or more processors, a policy identifier that identifies a policy being implemented by the settings associated with the one or more features of the BIOS;
retrieving, by the one or more processors, a public key associated with an organization that acquired the computing device;
sending to a service, by the one or more processors, a request to validate the policy, the request including the policy identifier and the public key;
receiving, by the one or more processors, a response indicating that the policy is valid;
initiating, by the one or more processors, a reboot; and
modifying, by the one or more processors and during the reboot, the one or more features of the BIOS of the computing device based on the settings.
2. The method of claim 1 , wherein the settings associated with the one or more features of the BIOS comprise at least one of:
disabling an imaging device associated with the computing device;
disabling a microphone associated with the computing device; or
disabling a port associated with the computing device.
3. The method of claim 1 , further comprising:
downloading, by a software agent associated with the organization, an encrypted package from the service, wherein the encrypted package includes the policy and a plurality of device identifiers.
4. The method of claim 3 , further comprising:
compiling, by the software agent, the policy to create the settings associated with the one or more features of the BIOS.
5. The method of claim 3 , further comprising:
sending, by the software agent, an executable file to a particular computing device of a plurality of computing devices acquired by the organization, the executable file including:
the settings associated with the one or more features of the BIOS; and
a particular device identifier of the plurality of device identifiers that corresponds to the particular computing device.
6. The method of claim 1 , wherein:
the settings associated with the one or more features of the BIOS include a policy identifier identifying a particular policy of a plurality of policies;
the settings implement the particular policy.
7. A computing device comprising:
one or more processors; and
one or more non-transitory computer-readable storage media to store instructions executable by the one or more processors to perform operations comprising:
receiving settings associated with one or more features of a basic input output system (BIOS) of the computing device;
receiving a device identifier that uniquely identifies the computing device;
determining a policy identifier that identifies a policy being implemented by the settings associated with the one or more features of the BIOS;
retrieving a public key associated with an organization that acquired the computing device;
sending a request to a service to validate the policy, the request including the policy identifier and the public key;
receiving a response from the service;
based at least in part on determining that the response indicates that the policy is valid:
initiating a reboot; and
modifying, during the reboot, the one or more features of the BIOS of the computing device based on the settings.
8. The computing device of claim 7 , the operations further comprising:
based at least in part on determining that the response indicates that the policy is invalid:
deleting the settings associated with the one or more features of the BIOS; and
providing a message indicating that the settings are invalid.
9. The computing device of claim 7 , wherein the settings associated with the one or more features of the BIOS comprise at least one of:
disabling a camera associated with the computing device;
disabling a microphone associated with the computing device; or
disabling a port associated with the computing device.
10. The computing device of claim 7 , wherein:
the policy is compiled to create the settings associated with the one or more features of the BIOS.
11. The computing device of claim 7 , wherein:
the service includes an account associated with the organization;
the account includes the policy; and
the account is accessed by presenting a digital certificate associated with the account.
12. The computing device of claim 7 , wherein:
the policy is created by a solution provider that is different from the organization.
13. The computing device of claim 7 , wherein:
the settings associated with the one or more features of the BIOS include a policy identifier identifying a particular policy of a plurality of policies; and
the settings implement the particular policy.
14. One or more non-transitory computer-readable storage media to store instructions executable by one or more processors of a target device to perform operations comprising:
receiving settings associated with one or more features of a basic input output system (BIOS) of the computing device;
receiving a device identifier that uniquely identifies the computing device;
determining a policy identifier that identifies a policy being implemented by the settings associated with the one or more features of the BIOS;
initiating a reboot;
modifying, during the reboot, the one or more features of the BIOS of the computing device based on the settings;
retrieving a public key associated with an organization that acquired the computing device;
sending a request to a service to validate the policy, the request including the policy identifier and the public key;
receiving a response from the service;
based at least in part on determining that the response indicates that the policy is valid, marking the BIOS as validated.
15. The one or more non-transitory computer-readable storage media of claim 14 , further comprising:
based at least in part on determining that the response indicates that the policy is invalid:
restoring the one or more features of the BIOS to one or more previous settings;
deleting the settings associated with the one or more features of the BIOS; and
providing a message indicating that the settings are invalid.
16. The one or more non-transitory computer-readable storage media of claim 14 , wherein the settings associated with the one or more features of the BIOS comprise at least one of:
disabling a camera associated with the computing device;
disabling a microphone associated with the computing device; or
disabling a port associated with the computing device.
17. The one or more non-transitory computer-readable storage media of claim 14 , wherein:
the policy is compiled to create the settings associated with the one or more features of the BIOS.
18. The one or more non-transitory computer-readable storage media of claim 14 , further comprising:
downloading, by a software agent associated with the organization, an encrypted package from the service, wherein the encrypted package includes the policy and a plurality of device identifiers.
19. The one or more non-transitory computer-readable storage media of claim 18 , further comprising:
sending, by the software agent, an executable file to a particular computing device of a plurality of computing devices acquired by the organization, the executable file including:
the settings associated with the one or more features of the BIOS; and
a particular device identifier of the plurality of device identifiers that corresponds to the particular computing device.
20. The one or more non-transitory computer-readable storage media of claim 14 , wherein:
the settings associated with the one or more features of the BIOS include a policy identifier identifying a particular policy of a plurality of policies; and
the settings implement the particular policy.