Learn About UEFI Secure Boot and Computer Security

What Is UEFI and How Does It Differ From Legacy BIOS?

UEFI stands for Unified Extensible Firmware Interface. It is the software that runs on your computer before your operating system loads. Think of firmware as the bridge between your computer's hardware and the programs you use every day. UEFI replaced an older system called BIOS (Basic Input/Output System) that had been used since the 1980s.

The main differences between UEFI and legacy BIOS matter for security. BIOS could only handle storage drives up to about 2 terabytes in size. UEFI can work with much larger drives—theoretically up to 9.4 zettabytes, which is far larger than any storage device made today. BIOS also used a simpler architecture that was more vulnerable to certain types of attacks.

UEFI introduced several improvements. It loads faster than BIOS on most modern computers. UEFI can display graphics and use a mouse, while BIOS was text-only. UEFI also includes better error checking and can run in 32-bit or 64-bit mode. Most importantly for security, UEFI created the foundation for Secure Boot, a feature that checks whether programs trying to run during startup are legitimate.

According to StatCounter data from 2023, approximately 95 percent of computers sold now use UEFI firmware instead of legacy BIOS. Most computers released after 2010 include UEFI as standard. If you bought your computer in the last decade, it almost certainly has UEFI rather than BIOS.

The shift to UEFI happened gradually. Computer manufacturers began transitioning around 2006 with Intel's announcement of the EFI specification. By 2010, UEFI became the standard on most new computers. Legacy BIOS is now considered outdated for modern security purposes.

Practical Takeaway: Understanding that UEFI is your computer's modern firmware foundation helps you grasp why security features like Secure Boot exist. If your computer was manufactured after 2010, you are almost certainly using UEFI rather than the older BIOS system. Check your system information in your operating system settings to confirm which firmware your computer uses.

Understanding Secure Boot and Its Purpose

Secure Boot is a UEFI security feature that verifies the integrity of your computer's startup process. When you turn on your computer, Secure Boot checks whether the bootloader and operating system files have been modified or replaced by malware. A bootloader is the program that loads your operating system into memory.

Here is how Secure Boot works in practice. When your computer starts, Secure Boot checks digital signatures on the files attempting to load. A digital signature is like a tamper-evident seal on a product package. If someone has altered the files, the signature will not match, and the computer will not load that software. The computer uses cryptographic keys stored in your firmware to verify these signatures. If the verification fails, your computer will either refuse to boot or display a warning message, depending on your settings.

Secure Boot protects against a specific category of threats called bootkits and rootkits. These malicious programs run before your operating system loads, which gives them deep access to your computer. A rootkit operating at this level can hide from antivirus software because it runs at a lower privilege level. By preventing unsigned code from running during boot, Secure Boot blocks these threats from loading in the first place.

Microsoft research indicates that Secure Boot has helped reduce the effectiveness of bootkit attacks. However, Secure Boot is not a complete solution by itself. It works as part of a layered security approach. A computer with Secure Boot enabled is significantly harder to compromise through boot-level attacks, but users still need antivirus software, firewalls, and good security practices.

Secure Boot uses a trusted platform module, or TPM, on many modern computers. A TPM is a specialized security chip that stores encryption keys and performs security functions. TPM version 2.0 has been available since 2014 and provides stronger security guarantees than earlier versions. However, Secure Boot functions without a TPM on computers that do not have this hardware.

Practical Takeaway: Think of Secure Boot as a security guard checking identification at the entrance to your computer's startup process. It verifies that the programs attempting to run during boot are legitimate and have not been tampered with. This prevents a whole category of malware from loading before your operating system begins.

How to Check If Secure Boot Is Enabled on Your Computer

You can check whether Secure Boot is currently enabled on your computer. The exact steps vary depending on whether you use Windows, macOS, or Linux, and which version of each operating system you have.

On Windows 10 and Windows 11, checking Secure Boot status is straightforward. Press the Windows key and R together to open the Run dialog. Type "msinfo32" and press Enter. This opens the System Information window. Look for a field labeled "Secure Boot State." It will show either "On" or "Off." If it shows "On," Secure Boot is currently active on your computer. If it shows "Off," Secure Boot is not currently protecting your system during startup.

Alternatively, you can check Secure Boot status through the Settings application. Open Settings and navigate to System, then About. Scroll down to find "System security." Under this section, you should see "Secure Boot" with a status indicator. Some Windows versions display this information in different locations, but it is generally found in the system information or settings areas.

On Apple computers running macOS, the situation is different. Apple's Macs use a security feature called Secure Boot starting with newer M-series processors and some Intel-based Macs. To check the status, restart your computer and hold Command + Option + R to enter Recovery Mode. Click Utilities, then Startup Security Utility. You will see your Secure Boot status listed as either "Full Security," "Reduced Security," or "Permissive Security."

If you use Linux, checking Secure Boot depends on your specific distribution. The most common method is to use a terminal command. Open a terminal and type "mokutil --sb-state" (for systems using UEFI with Secure Boot). The output will show whether Secure Boot is enabled or disabled. Some Linux distributions provide graphical tools for this as well.

The location of Secure Boot settings in your UEFI or BIOS varies by computer manufacturer. To access these settings, restart your computer and watch for a message during startup that says something like "Press F2 to enter Setup" or "Press Del to enter BIOS." The specific key varies by manufacturer—common keys include F2, F10, Del, and Esc. Once in the UEFI/BIOS menu, look for a tab or menu labeled "Security." Secure Boot settings are usually found there, though the exact location varies.

Practical Takeaway: Check your current Secure Boot status using the method appropriate for your operating system. Most modern computers have Secure Boot enabled by default for protection. If Secure Boot is disabled, you can review whether enabling it makes sense for your security needs, though changing these settings requires careful attention to avoid problems.

The Relationship Between Secure Boot, TPM, and Windows 11

Windows 11 introduced stricter security requirements than previous Windows versions. One of these requirements is TPM 2.0 support, which works closely with Secure Boot. TPM stands for Trusted Platform Module. This is a hardware security chip that stores cryptographic keys and helps protect sensitive data.

TPM 2.0 became an official requirement for Windows 11 installation. This means that to run Windows 11, your computer needs TPM 2.0 to be present and functioning. Many computers manufactured after 2016 include TPM 2.0, but not all of them. According to reports from the Windows 11 system requirements analysis, approximately 60 to 70 percent of computers worldwide currently meet all Windows 11 requirements, with TPM availability being one of the limiting factors.

The relationship between TPM 2.0 and Secure Boot works like this: Secure Boot verifies that your bootloader has not been modified. TPM 2.0 works with Secure Boot to store the keys used for verification and to create additional layers of security. Together