3.8.8. BIOS & UEFI Security

Learn how to increase the security of your system using configurable BIOS settings.

Passwords

Most manufacturers allow you to set a user password for signing into accounts. They also allow you to set an administrator password so that unauthorized users cannot edit BIOS settings. However, on older BIOS systems, the password can easily be cleared by removing the power from the CMOS chip. Attackers can use jumper cables to disconnect the CMOS battery from the CMOS chip, clearing it's contents. Newer UEFI chips are not typically vulnerable to this type of attack.

Drive Locking

Some manufacturers allow you to setup a drive password that is configured to the boot drive. On boot, as long as the user hasn't inputted the correct drive password, the system won't load into the OS. It's not vulnerable to jumper attacks since the password is actually an encrypted key saved on the drive itself.

Trusted Platform Modules

A TPM chip is a chip that can be installed on a motherboard to prevent drive moving. Drive moving is a technique the attackers use to gain access to files on your hard drive, simply by moving the drive from one computer to another. This is used to circumvent ACLs designed to block unauthorized access.

TPM chip provide cryptography functions that provide full support for asymmetric encryption. This is used to protect the keys that are used to lock the hard drive. Tools like Windows-BitLocker use the TPM chip. On boot, if the TPM chip is enabled, it will check a key or hash that was taken of the hardware and verify that the hardware hasn't changed. If it has, it will prevent the system from booting.

Applications installed on the system can also use the TPM chip for their cryptographic purposes.

Full-Disk Encryption

Some systems provide the option to encrypt the entire hard drive without the use of tools like Windows BitLocker. First, you have to setup your user and administrator passwords. Then, in your BIOS settings, you can create a security key that's used to encrypt all the contents of your hard drive. Make sure to export that key to somewhere save like a USB drive.

LoJack

Systems that are prone to being stolen, like notebooks, often have a feature called LoJack. Systems installed with LoJack have a chip that continuously contacts the LoJack headquarters server to update it with the systems geolocation, and to also check whether or not the it has been flagged as stolen.

Secure Boot

#III

#Aplus