Instructor: In this lesson, we're going to explore
some of the security features
inside of the BIOS and the UEFI.
In addition to providing protections on our network
and in our operating system environment,
we also need to consider the security
of our pre-operating system environment.
This is the area of the computer
that can be attacked during the bootup phase,
and therefore, the bootloader protections
must be considered, including the BIOS and UEFI passwords,
the secure boot process, and the setting of permissions
on your motherboard's USB ports.
Remember, the BIOS and UEFI are two different types
of firmware that's used in our computers to assist us
during the loading and booting up of our operating system.
Each computer can have either the BIOS or the UEFI in it,
but not both.
The BIOS is the basic input/output system
and it's a firmware interface that initializes hardware
for an operating system in order for it to boot up.
The computers that rely on BIOS are going to use
a master boot record, or MBR, to hold their boot information
and identify the partitions of a given hard drive
that contain the operating system to load.
The BIOS is the older, more legacy type of firmware.
UEFI, or the unified extensible firmware initiative,
on the other hand, is a newer type of firmware.
The UEFI is a type of system firmware that provides support
for 64 bit CPU operations at boot time,
a full graphical user interface and mouse operations at boot
and better boot security.
Computers that rely on UEFI are going to use a GUID
partition table known as GPT to hold their boot information.
UEFI provides the ability to access and boot
from disks over two terabytes in size and provides
CPU-independent architecture and drivers,
as well as a pre-OS environment that can include
network capability and web browsing access.
Overall, UEFI is newer and more advanced than BIOS
and provides additional security and integrity checks
during the boot process, including secure boot.
Now, the BIOS and UEFI can be protected
using a few different types of passwords, too.
This includes the supervisor, administrator,
or setup password, the user or system password,
and the storage or hard drive password.
The supervisor, administrator, or setup password
is the first type of password that you're going to find
when you're using the BIOS or UEFI.
This password is used to protect the access
to the BIOS or UEFI configuration program
and prevents unauthorized users from accessing
this sensitive configuration tool.
If you set this password up, anytime somebody tries to enter
the BIOS or UEFI, it's going to require them to enter
the password prior to granting access,
but it won't prevent somebody from powering on the computer
and booting up into the normal operating system environment.
This password is almost always going to be set up on computers
in a corporate or enterprise network
so that your end users can't access the BIOS or UEFI
but your system administrators and technicians can
if they have the right password.
The user or system password is the second type
of password that can be configured in the BIOS or UEFI.
This password is used to lock access to the entire computer.
Whenever the computer is powered on,
it's going to stop and ask for a password.
If the end user enters the correct password, the computer's
going to continue to load the operating system and boot up.
While this is a very secure method of protecting a computer,
it's almost never used in corporate or enterprise networks,
because this password would have to be shared
with all the users who access that computer,
and this shared password then negates some of that security
that we're trying to gain.
Instead, you're usually going to see a user or system password
used only on somebody's computer
when they're the only user on it.
This is a separate and different password
than the user password that's going to be used
to access Windows, Linux or the MacOS system,
and instead grants the user access to the system
in that pre-operating system environment.
The third type of password is known as a storage
or hard drive password.
This type of password used to be very popular
prior to the inclusion of the trusted platform module
or hardware security module in modern computers.
This password would lock access to a hard drive
that's connected to a system and would require the end user
to enter the password in order for that hard disc
to be read from and the operating system loaded.
Unlike that user or system password that locks the user
out of the entire system until the proper password
is entered, the storage or hard drive password
will only lock them out of the hard drive
and the ability to boot that operating system from it.
The next security feature we need to cover
is known as secure boot.
Secure boot can be enabled in the UEFI interface
and settings and is not supported by BIOS.
If enabled, it's going to perform three different verifications
during the bootup process for Windows or other
operating systems that support this capability in order
to ensure the computer has not been hijacked by some kind
of malicious code injected into the operating system.
Let's take a look at the full bootup process
on a normal Windows system.
The first step of the process occurs when a Windows computer
is starting up, the firmware boot components are loaded,
and the boot manager is started.
Next, the Windows loader is going to begin,
the Windows kernel is going to be started,
and the boot critical driver installations
are going to occur.
Now, any additional operating system initializations
are going to happen, and finally, the user is presented
with the Windows login screen.
Now, when the firmware boot components are loaded
during a secure boot, the firmware is first going to verify
that all the UV executable files and the OS loader itself
have their integrity intact and they haven't been
compromised by any kind of malware.
This means they're going to be safe to load up.
Next, the Windows boot components are going to verify
the digital signature of each component
prior to loading them.
If any component fails this signature check,
it's not going to load and it's going to trigger an alert
to the end user.
Finally, the boot critical drivers are going to be checked
against their known good hashes, and if they pass
this check, they're going to be loaded up as the final part
of the secure boot process.
Now, when it comes to secure boot, I want you to remember
that this is a procedure that's going to be used to ensure
that our operating system itself can be trusted
and it's not fallen victim to a special type of malware
known as a root kit.
For secure boot to work, it has to be enabled
inside of your UEFI system, and your operating system
also has to support it.
The final security feature we need to cover within the BIOS
or UEFI is setting up permissions for your USB ports
on your motherboard.
Now, most modern systems can be configured to enable
or disable the USB ports on your motherboard,
and some will even allow you to restrict the USB ports
so that they're not going to support certain types
of USB devices will still allowing others to be used.
Now, the big concern here is normally going to be
with malware and data loss.
In terms of malware, USB ports can provide a great avenue
of attack for somebody who's trying
to break into your system.
For example, if I load up a USB thumb drive
with some malware, I can drop it in a parking lot
outside of an office building, and if somebody's curious
and picks it up and plugs it into their machine,
that can then install malware onto your systems.
So we want to prevent this by disabling the ability
of USB to read and write from mass storage devices.
You can do this by either blocking USB altogether,
but then you wouldn't be able to use things like headphones
and webcams, mice and keyboards, and things like that.
So instead, we might want to just restrict the ability
to use them as mass storage devices, and this would prevent
anything like USB thumb drives or flash drives
or external hard drives from being connected to the system.
This can help us to prevent malware
from being introduced into our system.
But in addition to that, it also could help us prevent data
from getting out of our system.
For example, let's say you work for a top secret
organization within the government.
You wouldn't want somebody to be able to walk in
with a small USB thumb drive, plug it into the computer,
and download all of your information
and then walk out the front door with it.
So to prevent this, you can actually configure your UEFI
to block those USB ports or to prevent them from being used
for mass storage devices, and again, blocking the ability
to use thumb drives and external hard drives,
which will make it so that people can't walk out
the front door with your critical information.
So remember, when it comes to security, there's three
main things that your BIOS or UEFI can provide you with.
The first is the ability to set passwords to control
different access to different parts of your system.
The second is the ability to enable secure boot
to ensure your operating system has not been compromised
prior to loading it.
And third is the ability to restrict or disable USB ports
on your motherboard to prevent malware
from being introduced into the system,
or data from being exfiltrated from your system.