I am having a problem understanding some security techniques and was hoping someone could clarify some things. For instance, in terms of an evil maid attack, what are some solutions to preventing this? Is booting from removable media a solution to this? What does that entail? Let's say the OS I am using is a Linux live boot system. Does that mean that it is protected from this kind of attack or does booting from removable media mean that I am copying my boot sector on my PC and each time I boot I plug it in and boot that then go on to boot whatever OS that I am trying to use? Would this differ whether I am using a live OS vs an installed OS on my PC?
An evil maid attack affects the BIOS/UEFI of the pc correct? If I am confused, I am wondering what is the best way to protect against malware/spyware in the boot sector of a PC? Does TPM or secure boot help protect against this? I am assuming secure boot does. Also this is specifically regarding Linux as, I do not know if TPM is only for Windows or not or if it can be implemented with Linux.
Other than booting from removable media and what that is/entails, anything to do with hardening your device against physical access attacks using only Linux OS's would be greatly helpful.
If evil maid is booting from removable media, the most secure way to prevent that is by turning off all USB ports in the bios and turning on secure boot or TPM correct? So TPM and secure boot will also prevent someone from installing malware in the BIOS to infect every new system you install. Secure boot and TPM are two different things correct? Do both of them virtually do the same thing? From what you said it looks as if TPM also encrypts the hard drive as well? If so would that be better than LUKS?
My threat model would basically just be wanting to stop anyone from booting from removable media to try and alter the system or installing malware in the UEFI that would install itself after the system is decrypted and booted. So if my system is completely encrypted then that will basically stop anyone from altering the system using removable media correct? Then the only other thing I need to worry about is someone installing malware in the BIOS. So is there a way to put all boot files on a USB drive and have the PC boot from those every time so I know they are safe being that they would be with me all the time? What would be the easiest way as in most likely to work for most Linux systems? Like TPM, Secure boot, USB boot files, etc?