News

HP Wolf Security Study Reveals Alarming Platform Security Gaps In Device Lifecycle

Published

1 year ago

December 12, 2024

Editor

HP Inc. (NYSE: HPQ) has released a new report highlighting the far-reaching cybersecurity implications of failing to secure devices at every stage of their lifecycle.

This was made known in a statement released on December 12, 2024.

The findings show that platform security, securing the hardware and firmware of PCs, laptops, and printers, is often overlooked, weakening cybersecurity posture for years to come.

The report, based on a global study of 800+ IT and security decision-makers, ITSDM, and 6000+ work-from-anywhere employees, shows that platform security is a growing concern, with 81% of IT decision-makers agreeing that hardware and firmware security must become a priority to ensure attackers cannot exploit vulnerable devices.

However, 68% report that investment in hardware and firmware security is often overlooked in the total cost of ownership for devices. This is leading to costly security headaches, management overheads, and inefficiencies further down the line.

According to the statement, Key findings from across the five stages of the device lifecycle include:
Supplier Selection: In addition, 34% say a PC, laptop or printer supplier has failed a cybersecurity audit in the last five years, with 18% saying the failure was so serious that they terminated their contract. 60% of ITSDMs say the lack of IT and security involvement in device procurement puts the organization at risk.

Onboarding and Configuration: More than half (53%) of ITSDMs say BIOS passwords are shared, used too broadly, or are not strong enough. Moreover, 53% admit they rarely change BIOS passwords over the lifetime of a device.

Ongoing Management: Over 60% of ITSDMs do not make firmware updates as soon as they’re available for laptops or printers. A further 57% of ITSDMs say they get FOMU (Fear Of Making Updates) in relation to firmware. Yet 80% believe the rise of AI means attackers will develop exploits faster, making it vital to update quickly.

Monitoring and Remediation: Every year, lost and stolen devices cost organizations an estimated $8.6bn. One in five WFA employees have lost a PC or had one stolen, taking an average 25 hours before notifying IT.

Second Life and Decommissioning: Nearly half (47%) of ITSDMs say data security concerns are a major obstacle when it comes to reusing, reselling, or recycling PCs or laptops, while 39% say it’s a major obstacle for printers.

“Buying PCs, laptops or printers is a security decision with long-term impact on an organization’s infrastructure. The prioritization, or lack thereof, of hardware and firmware security requirements during procurement can have ramifications across the entire lifetime of a fleet of devices – from increased risk exposure, to driving up costs or negative user experience – if security and manageability requirements are set too low compared to the available state of the art,” warns Boris Balacheff, Chief Technologist for Security Research and Innovation at HP Inc.

Balacheff continues: “It’s essential that end-user device infrastructures become resilient to cyber risks. This starts with prioritizing the security of hardware and firmware and improving the maturity of how they are managed across the entire lifecycle of devices across the fleet.”

The report highlights the growing need for IT and security to be part of the procurement process for new devices, to set the requirements and verify vendor security claims, Oversights in the supplier selection process and onboarding and configuration limitations impact device security across the lifecycle.

52% of ITSDMs say procurement teams rarely collaborate with IT and security to verify suppliers’ hardware and firmware security claims.
45% of ITSDMs admit they have to trust suppliers are telling the truth as they don’t have the means to validate hardware and firmware security claims in RFPs.
48% of ITDMS even say that procurement teams are like “lambs to the slaughter” as they’ll believe anything vendors say.

78% of ITSDMs want zero-touch onboarding via the cloud to include hardware and firmware security configuration to improve security.
57% of ITSDMs feel frustrated at not being able to onboard and configure devices via the cloud.
Almost half (48%) of WFA workers who had a device delivered to their home complained that the onboarding and configuration process was disruptive.

“You will always need to choose technology providers you can trust. But when it comes to the security of devices that serve as entry points into your IT infrastructure, this should not be blind trust,” comments Michael Heywood, Business Information Security Officer, Supply Chain Cybersecurity at HP Inc. “Organizations need hard evidence – technical briefings, detailed documentation, regular audits and a rigorous validation process to ensure security demands are being met, and devices can be securely and efficiently onboarded.”

Challenges and frustrations around the ongoing management, monitoring and remediation of devices, 71% of ITSDMs say the rise in work-from-anywhere models has made managing platform security more difficult, impacting worker productivity and creating risky behaviors:

One in four employees would rather put up with a poor-performing laptop than ask IT to fix or replace it because they can’t afford the downtime.
49% of employees have sent their laptop to be repaired, and say this took over 2.5 days to fix or replace the device, forcing many to use their personal laptop for work or to borrow one from family or friends, blurring the lines between personal and professional use.
12% had an unauthorized third-party provider repair a work device, potentially compromising platform security and clouding IT’s view of device integrity.

Monitoring and remediating hardware and firmware threats to prevent threat actors accessing sensitive data and critical systems is vital. However, 79% of ITSDMs say their understanding of hardware and firmware security lags behind their knowledge of software security. Moreover, they lack mature tools that would give them the visibility and control they would want to manage hardware and firmware security across their fleets:

63% of ITSDMs say they face multiple blind spots around device hardware and firmware vulnerabilities and misconfigurations.
57% cannot analyze the impact of past security events on hardware and firmware to assess devices at risk.
60% say that detection and mitigation of hardware or firmware attacks is impossible, viewing post-breach remediation as the only path.

“Post-breach remediation is a losing strategy when it comes to hardware and firmware attacks,” warns Alex Holland, Principal Threat Researcher in the HP Security Lab. “These attacks can grant adversaries full control over devices, embedding deep within systems. Traditional security tools are blind to these threats as they tend to focus on the OS and software layers, making detection nearly impossible. Preventing or containing these attacks in the first place is critical to stay ahead, or else organizations risk a threat they cannot see and cannot remove.”

Second life and decommissioning: how data security concerns are leading to an e-waste epidemic

Platform security concerns are also impeding organizations’ ability to reuse, recycle or resell end of life devices:

59% of ITSDMs say it’s too hard to give devices a second life and so they often destroy devices over data security concerns.
69% say they are sitting on a significant number of devices that could be repurposed or donated if they could sanitize them.
60% of ITSDMs admit their failure to recycle and reuse perfectly usable laptops is leading to an e-waste epidemic.

Complicating matters further, many employees sit on old work devices. This not only prevents devices from being repurposed, but it also creates data security risks around orphaned devices that still may carry corporate data.

70% of WFA employees have at least 1 old work PC/laptop at home or in their office workspace.
12% of WFA workers have left a job without returning their device right away – and almost half of these say they never did.

More than two thirds (69%) of organizations say their approach to managing device hardware and firmware security only addresses a small part of their lifecycle. This leaves devices exposed, and teams unable to monitor and control platform security from supplier selection to decommissioning.

Addressing these platform security gaps, HP Wolf Security recommends a comprehensive approach to managing device hardware and firmware security across the entire lifecycle. This includes collaborative supplier selection and auditing, secure zero-touch onboarding and configuration, ongoing monitoring and management, effective monitoring and remediation, and secure decommissioning and second-life management.

News

Xenophobic Attacks: Oshiomhole Tells FG To Retaliate Against South African Companies In Nigeria

Published

9 hours ago

May 5, 2026

Editor

Senator Adams Oshiomhole has called on the Federal Government to retaliate against South African businesses operating in Nigeria following the recent attacks on Nigerians in South Africa.

Speaking during plenary on Tuesday, Oshiomhole said the Federal Government should consider revoking the working license of South African owned companies such as MTN and DSTV.

He argued that Nigeria must respond firmly to what he described as persistent hostility against its citizens.

“I am not going to shed tears. If you hit me, I hit you. I think it is appropriate in diplomacy. It is an economic struggle,” Oshiomhole said.

He argued that while some South Africans accuse Nigerians of taking their jobs, Nigerians should return home and take over employment opportunities created by major South African companies operating in the country, including MTN and DSTV.

“When we hit back, the President of South Africa will not only talk but will also go on his knees to recognise that Nigeria cannot be intimidated.

“We will not condone any life being lost. If a crime has been committed under the South African law they have the right to bring any such person to justice, but to kill our people as if we are helpless, we will not allow that,” Oshiomhole added.

DAILY POST reports that several Nigerians in South Africa have reportedly been attacked, and their businesses destroyed, in ongoing xenophobic attacks in the country.

News

IGP Orders Officers Display Name Tag On Uniform, Gives Update On State Police

Published

9 hours ago

May 5, 2026

Editor

The Inspector General of Police, IGP, Tunji Disu, has ordered all police personnel to always have their name tags on their uniforms for easy identification.

Disu disclosed that only police personnel who are undercover are exempted from displaying their name tags.

Speaking on Tuesday, Disu said: “All police officers should have their name tags. All of us on the high table have our names apart from the undercover among us so if you look at all the Commissioners of Police we have our name tags, so it’s not our standard.

News

Court Orders SERAP To Pay DSS Operatives N100m For Defamation

Published

14 hours ago

May 5, 2026

Editor

The High Court of the Federal Capital Territory has ordered a non-governmental organization, the Socio-Economic Rights and Accountability Project, SERAP, to pay N100 million as damaged to two operatives of the Department of the State Services, DSS, for unjustly defaming them in some publications.

The court also ordered SERAP to tender public apologies to the defamed officers,
Sarah John and Gabriel Ogundele, in two national newspapers, two television stations and its website.

Besides, the organization was also ordered to pay the two operatives N1 million as cost of litigation and 10 percent post-judgment interest annually on the judgment sum until it’s fully liquidated.

Justice Yusuf Halilu of the High Court of the Federal Capital Territory gave the order on Tuesday while delivering judgment in a N5.5 billion defamation suit instituted against SERAP by the DSS operatives.

The judge found SERAP liable for unjustly defaming the two DSS operatives with allegations that they unlawfully invaded its Abuja office, harassed and intimidated its staff, in September 2024.

In the offending publication on its website and Twitter handle, SERAP alleged that the two operatives unlawfully invaded and occupied its office with sinister motives.

The judge held that the publication was in bad taste especially from an organization established to promote transparency and accountability, as nothing in the publication was found to be truthful.

The DSS staff had listed SERAP as 1st defendant in the suit marked CV/4547/2024. SERAP’s Deputy Director, Kolawole Oluwadare, was listed as the 2nd defendant.

In the suit, the claimants – Sarah John and Gabriel Ogundele – accused the two defendants of making false claims that they invaded SERAP’s Abuja office on September 9, 2024..

Counsel to the DSS, Oluwagbemileke Samuel Kehinde, had while adopting his final address in the mater urged the judge to grant all the reliefs sought by his client in the interest of justice.

He admitted that although the names of the two claimants were not mentioned in the defamation materials, they had however established substantial circumstances that they are the ones referred to in the published defamation article by SERAP on its website.

The counsel submitted that all ingredients of defamation have been clearly established and the offending publication referred to the two officials of the secret police.

However, SERAP, through its counsel, Victoria Bassey from Tayo Oyetibo, SAN, law firm, asked the court to dismiss the suit on the ground that the two claimants did not establish that they were the ones referred to in the alleged defamation materials.

She said that SERAP used “DSS officials” in the alleged offending publication, adding that the two claimants must establish that they are the ones referred to before their case can succeed.

Similar arguments were canvassed by Oluwatosin Adefioye who stood for the second defendant, adding that there was no dispute in the September 9, 2024 operation of DSS in SERAP’s office.

He said that since SERAP in the publication did not name any particular person, the claimants must plead special circumstances that they were the ones referred to as the DSS officials.

Besides, he said that there is no organization by name Department of State Services in law, hence, DSS cannot claim being defamed adding that the only entity known to law is National Security Agency.

The claimants had in the suit stated that the alleged false claim by SERAP has negatively impacted on their reputation.

The DSS also stated, in the statement of claim, that, in line with the agency’s practice of engaging with officials of non-governmental organisations operating in the FCT to establish a relationship with their new leadership, it directed the two officials – John and Ogunleye – to visit SERAP’s office and invite them for a familiarization meeting.

The claimants added that in carrying out the directive, John and Ogunleye paid a friendly visit to SERAP’s office at 18 Bamako Street, Wuse Zone 1, Abuja on September 9 and met with one Ruth, who upon being informed about the purpose of the visit, claimed that none of SERAP’s management staff was in the country and advised that a formal letter of invitation be written by the DSS.

John and Ogundele, who claimed that their interactions with Ruth were recorded, said before they immediately exited SERAP’s office, Ruth promised to inform her organisation’s management about the visit and volunteered a phone number – 08160537202.

They said it was surprising that, shortly after their visit, SERAP posted on its X (Twitter) handle – @SERAPNigeria – that officers of the DSS are presently unlawfully occupying its office.

The claimant added, “On the same day, the defendants also published a statement on SERAP’s website, which was widely reported by several media outfits, falsely alleging that some officers from the DSS, described as “a tall, large, dark-skinned woman” and “a slim, dark skinned man,” invaded their Abuja office and interrogated the staff of the first defendant (SERAP).

John and Ogundele stated that “due to the false statements published by the defendants, the DSS has been ridiculed and criticised by international agencies such as the Amnesty International and prominent members of the Nigerian society, such as Femi Falana (SAN)”.

“Due to the false statements published by the defendants, members of the public and the international community formed the opinion that the Federal Government is using the DSS to harass the defendants.”

They added that the defendants’ statements caused harm to their reputation because the staff and management of the DSS have formed the opinion that the claimants did not follow orders and carried out an unsanctioned operation and are therefore, incompetent and unprofessional.

The claimants therefore prayed the court for the following reliefs: “An order directing the defendants to tender an apology to the claimants via the first defendant’s (SERAP’s) website, X (twitter) handle, two national daily newspapers (Punch and Vanguard) and two national news television stations (Arise Television and Channels Television) for falsely accusing the claimants of unlawfully invading the first defendant’s office and interrogating the first defendant’s staff.

“An order directing the defendants to pay the claimants the sum of N5 billion as damages for the libellous statements published about the claimants.

“Interest on the sum of N5b at the rate of 10 percent per annum from the date of judgment until the judgment sum is realised or liquidated.

“An order directing the defendants to pay the claimants the sum of N50 million as costs of this action.”