Approaches for ensuring data security

A method for securing a client, comprising:

• a BIOS agent storing policy data within a BIOS of the client, wherein the BIOS agent is one or more modules operating at runtime in the BIOS of the client, wherein the policy data is capable of being updated from a server after an operating system on the client has loaded, and wherein the policy data describes one or more security policies followed by the client after the operating system has loaded;
• upon the BIOS agent receiving updated policy data from the server while the operating system executes, the client enforcing any new security policies described by the updated policy data without rebooting the client;
• and
• in response to the client following at least one of the one or more security policies, locking a hard-disk drive (HDD) of the client by instructing a controller present in the hard-disk drive (HDD) to deny, to any entity, access to data stored on the hard-disk drive (HDD) unless the entity supplies, to the controller, a recognized authentication credential.

An apparatus for securing resources thereof, comprising:

• one or more processors;
• and
• one or more machine-readable non-transitory mediums storing one or more sequences of instructions, which when executed by the one or more processors, cause:
• a BIOS agent to store policy data within a BIOS of the client, wherein the BIOS agent is one or more modules operating at runtime in the BIOS of the client, wherein the policy data is capable of being updated from a server after an operating system on the client has loaded, and wherein the policy data describes one or more security policies followed by the client after the operating system has loaded:
• upon the BIOS agent receiving updated policy data from the server while the operating system executes, the client enforcing any new security policies described by the updated policy data without rebooting the client;
• and
• in response to the client following at least one of the one or more security policies, a persistent storage medium of the client to lock by instructing a controller present in the persistent storage medium to deny, to any entity, access to data stored on the persistent storage medium unless the entity supplies, to the controller, a recognized authentication credential.