What would be the best security practice to protect a device from physical attack? For instance an Evil Maid or boot sector malware?
For this question we are going to go with a UEFI boot debian linux OS laptop. Obviously, encrypting the OS is going to be my first step. Next, I assume something like Secure Boot & TPM.
I am kind of confused on two. Locking down USB ports so they are unable to be used. I can do that in in bios settings correct? I don't know if it is possible but can you completely copy all boot files to a read-only USB and boot from that read-only USB every time you boot the OS so you know that it is safe? In another question someone stated that someone could come in and modify the OS and leave so when you come back and decrypt it, it can steal your password. How would this be possible if your USB ports are blocked and everything is signed/secure with you?
What would be the steps one would take to secure against this type of attack as much as possible and any attack vectors that could possibly still be exploited regardless of the steps that are taken?