Abstract: A computing device having a data store for storing firmware is configured such that, upon determining that a connection to a firmware device has been activated, the computing device determines whether an image hash of a previous firmware baseline exists and takes a snapshot or hash of the firmware if an image hash does not exist. The device uses the image hash to determine whether a change has been made to the firmware stored in the data store. The device conducts a malware treatment upon determination that a change has been made to the firmware.