BIOS/UEFI and Encryption

What is BIOS?

Basic input output system

• Legacy 16-bit firmware stored on a chip

• Initialise his hardware at boot and loads the OS boot loader from the MBR

• Limited to 2.2 TB drives and four primary partitions

What is UEFI?

Unified extensible firmware interface

• replacement for BIOS (32/64 bit)

• Support secure boot, faster boot times, graphical interface, and mouse support

What is secure boot?

A UEFI feature that verifies the digital signature of boot loaders and OS kernels before loading them

• Prevents unauthorised or malicious code (boot kits/root kits) from running at start-up

• Require requires signed boot loaders - Modern Windows and Linux distribution support it

What are common BIOS/UEFI settings a technician configures?

• Boot order/priority - Which device the system boots from first?

• USB permissions - Disable/enable USB ports

• Fan settings

• Boot password / BIOS password

• TPM Settings - Enable TPM for bitlocker/Windows 11

• Temperature monitoring

What is TPM?

Trusted Platform Module

• A dedicated security coprocessor or cryptoprocessor installed onto motherboard

• When enabled makes it so that the UEFI will only boot to an authenticated boot device - known as sealing

What is a Hardware Security module (HSM)?

Dedicated hardware device (internal card or external appliance) that generates, stores, and managers cryptographic keys at high speed

• used in enterprise and financial environments

What is the difference between HSM and TPM?

• HSM is much more powerful and expensive than a TPM

• HSM is a purpose-built crypto appliance for managing cryptographic keys across an organisation

• A TPM is built into the motherboard

What is the CMOS battery?

A small coin sized cell battery on the motherboard

• maintains the BIOS/UEFI Settings and the real time clock when the system is powered off

What happens if the CMOS battery fails?

• The system loses date/time on every power cycle

• BIOS settings reset to default, or system won’t POST

What AMD CPU feature is required for hardware virtualisation?

AMD-V (AMD Virtualisation)

What Intel CPU feature is required for hardware virtualisation?

Intel VT-x (Virtualisation Technology)

What do AMD-V and Intel VT-x do?

They are hardware extensions that allow the CPU to efficiently run multiple virtual machines

• Must be enabled in EIOS/UEFI Settings

What is IOMMU and why is it relevant to virtualisation?

Input output memory management unit

• Allows a VM to directly access hardware devices with near native performance

• A feature called PCIe passthrough