What is Secure Boot? Requirement for Windows 11

What is Secure Boot? 

Secure boot is a security feature that only lets approved software run when a computer starts up. This helps ensure that unauthorized programs, especially harmful rootkits, cannot start up with the computer and avoid detection by antivirus software. To install the latest operating system, Windows 11, secure boot must be enabled as it is a required part of the UEFI (Unified Extensible Firmware Interface) or BIOS settings. While it's not needed for older Windows versions like Windows 10 IoT 2021 LTSC, it's crucial for industrial enterprise applications.
 

How does Secure Boot Work? 

Secure Boot, a part of the UEFI BIOS, ensures that only trusted software runs when a computer boots up. It works together with the TPM (Trusted Platform Module), which is also necessary for installing Windows 11. TPM 2.0 is a physical security device that enhances data protection beyond what software alone can offer. It stops the computer from booting if the hardware has been tampered with or if unauthorized software tries to run. Secure Boot adds another layer of security by allowing only certified programs to start.
Let's discuss the three main databases involved in this process:

• Signature Database (DB): This database holds the public keys and certificates of trusted firmware, operating system loaders like Microsoft’s, and various UEFI applications and drivers.
• Revoked Signature Database (DBX): This database lists hashes of known harmful or vulnerable components, including compromised keys and certificates, preventing them from running and safeguarding your system.
• Key Exchange Key (KEK): The KEK is crucial for maintaining a trust relationship between the operating system and the firmware, containing public keys used when updating trusted or blocked lists. A system can have multiple KEKs, which manage access to these lists.
• Platform Key (PK): The platform key builds a trust link between the system owner and the BIOS firmware, regulating who can update the KEK Database.

Why is it useful for Industrial Edge Applications? 

As cyberattacks increase worldwide, it's essential for enterprises to adopt every possible measure to protect their data from unauthorized access and tampering. Leading companies such as Microsoft, AMD, and Intel have developed advanced security methods to combat malware effectively. Microsoft has introduced Windows 11, requiring TPM 2.0 and Secure Boot to bolster security. Similarly, semiconductor leaders Intel and AMD have created their own versions of firmware TPM (fTPM). Previously, TPM was mainly used by enterprises dealing with sensitive data. However, with the rise in cyber threats, TPM 2.0 has become nearly essential, especially for industrial edge computers.

What is the difference between Secure Boot and TPM 2.0?

Secure Boot is a straightforward security measure activated through the UEFI BIOS. Its primary function is to ensure that only verified and digitally signed software, such as the operating system and essential startup applications like anti-malware programs, are allowed to launch. On the other hand, TPM 2.0 functions like a secure vault that stores and encrypts sensitive digital keys and certificates necessary for booting the system. If TPM identifies hardware changes like a new hard drive, or if there's an issue with the operating system license, it will prevent the computer from booting. Secure Boot serves as a security checkpoint, granting access only to authenticated startup programs.
 

What are some disadvantages/downsides of Secure Boot?

Secure Boot enhances security by ensuring only trusted software runs during system startup, but it comes with some notable downsides:

• Compatibility Issues: It may block some legitimate software, including older operating systems and some Linux distributions, if they haven't been properly signed.
• Restriction on Custom Software: Users with custom or specialized software not recognized by a certificate authority might find Secure Boot limiting.
• Setup Complexity: Configuring Secure Boot settings can be complex and intimidating for less technical users.
• Potential for Vendor Lock-in: Manufacturers might use Secure Boot to restrict user choice by favoring their own products.
• False Sense of Security: It's not a comprehensive solution, which could lead users to neglect other important security measures.
• Difficulties in Dual-Booting: Secure Boot can complicate the installation and management of multiple operating systems.
• Recovery Challenges: It can make using recovery tools difficult unless it is temporarily disabled.

How to enable Secure Boot for Windows 11? 

First, let's see if Secure Boot is already turned on. Type 'msinfo32' into the Windows search bar, and then look for 'Secure Boot State'. If it shows ON, Secure Boot is enabled. If it shows OFF, you can turn it on in the UEFI BIOS. Check your motherboard manual for instructions on how to navigate the UEFI BIOS to enable Secure Boot. After enabling, verify again if Secure Boot is active. If you need to turn off Secure Boot, you can do so by entering the UEFI BIOS and disabling it. While it's recommended to keep Secure Boot enabled since it doesn't significantly impact performance or compatibility, turning it off is not required unless you're not downloading any rootkits or malicious programs, in which case Secure Boot isn't necessary for using your computer.