NovaCustom explains the importance of digital sovereignty with cyber resilience at the firmware level
Most laptops that can be found in shops today are made in China and equipped with Microsoft Windows 11. “That’s exactly the problem”, says Wessel klein Snakenborg, founder and CEO of NovaCustom – a custom laptop manufacturer from the Netherlands.
Software means dependency, even if we’re just talking about the source code. So you must ask yourself: “Do we want to be dependent on software that we do not and cannot control, that originates from China or the United States?”
As many cyber security experts agree, using open-source software is a solution to this dependency issue, but this is not just limited to the applications we are working with.
Back in the 90s, Linus Torvalds created Linux, one of the world’s most successful open-source applications. Today, millions of servers worldwide are running this secure operating system, which has been audited by thousands of cyber security experts worldwide.
Open-source servers, closed-source laptops?
While a lot of organisations recognise the advantages of using open-source applications, such as Linux servers running Apache, Nginx or PHP, lots of them haven’t considered this yet for workstations, including laptops.
For laptops, most of us are still using proprietary Chinese firmware that cannot be updated, with closed-source American Windows software on top. As a result, these organisations don’t have real control over the security of the operating system and the device itself.
Operating system: Windows vs Linux
If digital sovereignty is so important in 2026, why are we still using Windows as our operating system on laptops and computers? The answer is simple: we are used to it, it’s convenient and it is probably pre-installed.
But that doesn’t mean that there are no alternatives to American big-tech operating systems, such as Microsoft Windows, Apple MacOS or one of Google’s OSes. In fact, you can have an independent operating system that you can control. Linux gives you the power, freedom and the cyber resilience that your organisation needs.
So, is Linux more secure than Windows? Yes, definitely. This is because most malware targets Windows. Additionally, Windows has only been audited by one company, which is Microsoft, whereas Linux has been audited by thousands of security professionals worldwide.
But Linux has more advantages. It runs much faster and you can install updates more easily in the background. Yes, this means that you no longer have time for a coffee break while Windows is installing updates when you turn your computer on. Jokes aside, having updates installed in a few minutes is just amazingly convenient.
Did you know that Microsoft shares your data with more than 960 partners if you accept the default and recommended privacy settings? This alone should be a deal-breaker. Be aware that there are a lot of Linux versions (so-called distributions) and each distribution has its own focus.
To give you an example, Zorin OS is focused on users who are switching from Windows or MacOS to Linux, and Ubuntu is one of the most popular Linux distributions with extensive enterprise support. NixOS focuses on reproducibility, while Qubes OS focuses on extreme security by VM isolation of workflows.
Firmware also matters
Firmware is the first software that runs on a device. Most people don’t think about it, but as soon as you press the power key on your laptop, the firmware is running. Since this is low-level code, the firmware has access to all components of the device. This makes the firmware extra vulnerable and a favoured target for sophisticated attackers.
The Intel Management Engine (ME): potential spyware?
Every modern x86 computer has an Intel Management Engine (ME). It’s basically another computer within your computer, which has access to all components, such as the network card and internal storage drive.
The Intel ME is always active as long as it is powered, even if the computer is turned off. Intel claims it is used for easy management for big enterprises. But the truth is, we don’t know much about it, as it is closed source.
Even though there aren’t many known cases of abuse of ME, knowing that the computer has a chip that could potentially be used for spyware is just scary. Organisations that take privacy and security seriously should want to mitigate such risk.
I hear you saying: “Why not another processor, such as AMD or Qualcomm?”
AMD has its own ME equivalent, which is AMD Platform Security Processor (PSP), while Qualcomm and other CPU brands might be less powerful or incompatible with your vital local applications. Fortunately, Intel ME can be disabled. However, the hardware should support ME disabling, as it is firmware-controlled. Also good to know… there are two ways of disabling Intel ME – HECI and HAP.
With HECI disabling, you basically instruct Intel ME to disable itself. But who knows for sure that it actually happens? With HAP disabling, Intel ME is brutally turned off. In fact, HAP disabling works like a kill switch for ME, so it is a more profound way of ME disabling.
Solution: use open-source firmware
If your organisation is striving for digital sovereignty, don’t forget the firmware.
Many cheaper Chinese-made laptops are equipped with firmware that is vulnerable, have Intel ME enabled by default and often cannot be updated.
Dasharo coreboot is a firmware variant that replaces proprietary Chinese firmware. It is equipped with extensive security features, such as UEFI Secure Boot and BIOS boot lock.
Moreover, the Intel Management Engine (ME) can be disabled with the HAP disabling method. It is also updateable, ensuring that vulnerabilities are being fixed over time.
NovaCustom delivers custom-made laptops with Dasharo coreboot open-source firmware. The laptops are assembled and installed in the Netherlands. While Microsoft Windows is still compatible, these laptops have been optimised for use with both Linux and the Qubes OS extremely secure operating system. The company also guarantees at least seven years of spare parts availability and firmware updates, ensuring flexibility and durability.
Disclaimer: The views, opinions, technical assessments and claims expressed in this article are those of NovaCustom and its representatives. SECURITY UPDATE has reproduced these views for industry discussion and awareness and does not independently endorse or verify all technical, comparative or security-related claims made in the article. Readers are advised to undertake their own technical and security assessments before making any product, technology or procurement decisions.
SU Opinion: These have considerable relevance to physical security, but the strongest value is not in conventional CCTV/access-control applications. It is particularly relevant wherever a physical security system depends on computers, edge devices, command platforms or security-critical data such as Security Operations Centres (SOCs) and Critical Infrastructure protection systems.
