In this lesson,
we will learn about boot options.
Boot options are methods and sequences
that determine how a system starts
and verifies its integrity
before the operating system loads.
Boot options include Secure Boot and Measured Boot,
where Secure Boot ensures that each component
loaded during the boot process
has a valid digital signature.
And Measured Boot records cryptographic hashes
of each component loaded during the boot process
into a Trusted Platform Module, or TPM,
to create a verifiable log of the boot sequence.
Let's learn more about Secure Boot and Measured Boot.
First, we have Secure Boot.
Secure Boot can be enabled
in the Unified Extensible Firmware Interface,
or UEFI settings.
UEFI is a modern type of system firmware
that offers advanced features
such as a graphical user interface,
mouse support during boot,
and improved security
compared to the older Basic Input/Output System, or BIOS.
UEFI also supports larger disks over two terabytes,
provides a CPU-independent architecture,
and allows a pre-operating system environment
that can include network capabilities and even web browsing.
When Secure Boot is enabled,
it performs three key verifications during the boot process
to ensure the system has not been compromised
by malicious code.
These three verifications are:
one, the firmware checks the integrity
of UEFI executable files and the operating system loader
to ensure they have not been tampered with.
Two, the Windows boot components
verify the digital signatures
of each component before loading,
blocking any that fail the check.
And three, the boot-critical drivers
are validated against their known good hashes,
allowing only verified drivers to load.
Before we explore how Secure Boot is implemented,
let's first review the typical Windows boot process
without Secure Boot.
The process begins with the loading
of firmware boot components,
which then start up the boot manager.
Next, the Windows loader is initiated,
followed by the startup of the Windows kernel.
After the kernel is loaded,
boot-critical drivers are installed
to ensure essential hardware
and system functions are operational.
Finally, the process concludes
with the presentation of the Windows login screen,
signaling that the operating system
is ready for user access.
This standard boot sequence
proceeds without verifying the integrity of the components,
leaving potential vulnerabilities unchecked.
In contrast, with Secure Boot enabled,
the boot process includes several security checks
to ensure that only trusted components are loaded.
First, the firmware verifies the integrity
of the UEFI executable files
and the operating system loader,
ensuring they have not been tampered with
and are safe to execute.
Next, Windows boot components
perform a digital signature check
on each component before loading.
If any component fails this verification,
it is blocked from loading and an alert is triggered,
preventing potentially harmful code from running.
Finally, boot-critical drivers
are verified against their known good hashes
to confirm they have not been altered.
Only drivers that match their expected hashes
are allowed to load,
securing the system
against unauthorized modifications during startup.
As a note, with Secure Boot,
you cannot use a dual-boot system or Linux
because Secure Boot only functions
with the Windows operating system.
After Secure Boot
has successfully completed all of these verifications,
the Windows login screen is presented.
This ensures the entire boot process has been validated,
confirming that no unauthorized changes
or malware have compromised the system's integrity.
So Secure Boot serves as a critical checkpoint
ensuring that the operating system
has started with only trusted and verified components,
significantly reducing the risk of boot-level attacks.
Second, we have Measured Boot.
Sometimes referred to as Trusted Boot,
Measured Boot is a security feature
that helps prevent attacks on the boot process
by checking the integrity
of software components during startup.
Measured Boot uses cryptographic hashing
to compare these components
against a known good catalog of expected hash values.
While this process can slightly slow down the boot time,
it does provide a valuable log of pre-boot activities
that can help detect potential malware within the system.
During the Measured Boot process,
the device's TPM checks the hashes of key system state data
at each stage of the boot sequence.
This includes essential components
such as the UEFI firmware, boot loader,
operating system kernel, and critical drivers.
If any of these components have been modified,
Measured Boot records these changes,
signaling potential security threats
that need investigation.
Importantly, even if discrepancies are detected,
Measured Boot does not halt the boot process,
but instead provides a record of what occurred.
So, Measured Boot
integrates seamlessly with UEFI in enhancing security
by recording each stage of the boot process
and securely storing these measurements in the TPM.
These logs can be accessed by remote management systems,
allowing security teams to verify system integrity
and identify any unauthorized modifications.
Working alongside UEFI and Secure Boot,
Measured Boot adds a critical layer of protection,
ensuring that the system boots securely
and maintains its integrity
throughout the entire boot process.
So remember, boot options are used to manage
how a system starts
and to verify integrity before the operating system loads,
with Secure Boot and Measured Boot
providing key security features.
Secure Boot focuses on blocking unauthorized software
by ensuring that each component
loaded during the boot process
has a valid digital signature,
preventing any untrusted or tampered code from running.
In contrast, Measured Boot does not block components
but instead records cryptographic hashes
of each boot component in the Trusted Platform Module,
creating a detailed log of the boot sequence
that can be analyzed later
for signs of tampering or malware.
In other words, Secure Boot actively prevents
the execution of untrusted software,
while Measured Boot provides visibility
into what has loaded,
allowing security teams to detect unauthorized changes
even after the system has started.
Together, Secure Boot and Measured Boot work with UEFI
to enhance security,
with Secure Boot ensuring only trusted software runs,
and Measured Boot providing a record of the boot process
for further validation.