There are a number of different options inside of your BIOS
that can help keep your system safe.
And in this video, we'll look at these options for biosecurity.
A common security feature in a BIOS is to set a password.
One type of password that you can set
is called either a buyer's password.
You may hear it also referred to as a user password.
This is a password that keeps the system from starting
unless you know the password.
When you boot your system, a password prompt
is presented on the screen.
And unless you know the password,
the system does not proceed any further.
And your operating system does not load.
The other type of password you might see
is a supervisor password.
A supervisor password doesn't stop the boot process.
The computer works as it normally would.
But if anybody ever goes into the BIOS
to make a configuration change, they'll
be prompted for the supervisor password.
And no changes to the BIOS can take place
until the correct supervisor password is entered.
This would be a way for a supervisor
to disable or lock down access to certain pieces of hardware.
For example, if a supervisor wanted
to disable all of the USB interfaces on a computer,
they can make those changes in the BIOS,
set a supervisor password, and then
be assured that no one else could go into the BIOS
configuration and undo all of those configuration changes.
Your BIOS can also help provide Full Disk Encryption
on your computer.
This is sometimes referred to as FDE,
where everything that is written onto a disk,
including the operating system, is completely encrypted.
If someone gained access to one of your devices
or tried to read information from your storage devices,
they would find that all of that information was encrypted.
In Windows, this full-disk encryption is called BitLocker.
And BitLocker integrates with a TPM.
This is a Trusted Platform Module.
It's a piece of hardware that's inside of your computer, maybe
a module that you add to a motherboard,
or it might be built into the motherboard that you're using.
This TPM has a random number generator.
It can help create cryptographic keys.
And it has a number of other advanced
cryptographic functions.
This TPM integrates with the BIOS
to provide the highest level of security for your data.
If someone was to steal your laptop,
you may be able to recover it if your laptop has
a function in the BIOS enabled called Lojack for Laptops.
This is software that was originally called CompuTrace.
And it allows you to track where your laptop is--
very similar to the vehicle recovery service called Lojack.
The software that enables this Lojack for Laptops
functionality is loaded into the operating system.
If someone deletes the software or installs a new operating
system, the BIOS will install the Lojack for Laptops software
into the new operating system.
This software allows your computer to phone home
and provide location information.
But there's also a theft mode associated
with the software, where you can remotely delete the operating
system, delete certain files, or force the laptop into having
a startup password, and effectively
make the laptop worthless to the person who may have stolen it.
One of the challenges we have with malicious software
is it can infect the operating system itself.
So when you start your computer, it's
already infected with this malware.
One way to prevent this is with a function called Secure Boot.
Secure Boot is part of the UEFI specification.
So if you're running a UEFI BIOS,
you also have the ability to use Secure Boot.
When your system starts up, Secure Boot
looks at the core operating system files of your system.
And it checks to see if there is a digital signature
for those files.
If the digital signature matches the files
that are on your hard drive, the system continues to boot.
If any of those core operating system files
have been modified, the digital signature will fail,
and Secure Boot will prevent your system from starting.
Support for Secure Boot is available in Windows, in Linux.
And in some of these operating systems,
they won't start unless you have Secure Boot enabled
in the BIOS.