What is Secure Boot?

Key Takeaways

• Secure Boot is a fundamental security feature that ensures a PC starts up securely by preventing malware from compromising the system during the startup process.
• Windows 11 devices, including the latest Surface devices, have Secure Boot enabled by default as part of Microsoft’s commitment to security.
• To verify Secure Boot’s activation on Windows 11, users can press Windows logo key + R, type "msinfo32”, navigate to System Summary, and confirm Secure Boot State reads "On”.

One of the most important processes a PC performs is, simply, turning on. During startup, each of the essentially components are activated and begin to communicate with each other. To ensure this is done securely every time, computer makers have developed Secure Boot. It’s a standard operation that helps protect your device from errors and corruption while it powers up.

Stay secure from the jump

A PC’s startup process is critical to maintaining its security. One of the sneakier ways for bad actors to take advantage of you is by secretly installing malware that can bypass operating system (OS) security and lie in wait until startup; by the time everything starts up, it’s already too late. Any number of bad outcomes are possible if this happens, including the transfer of private files, capture of cryptographic data, or recording passwords and keystrokes.

Rootkits, for one, are a sophisticated type of this malware. They run in kernal mode—a privileged mode of operation in which processes can execute with unrestricted access to things like hardware and memory. They are particularly dangerous because they have the same rights as the OS and start before it, completely hiding themselves and other applications.

What happens when a PC starts up?

To better understand the complexity, importance, and potential risks during startup, let’s look at the boot process a computer goes through. There are five steps that commonly happen at startup:

1. OS power on. When you turn your computer on, power is supplied throughout its components such as the motherboard, central processing unit (CPU), hard disks, solid-state drives, graphics processors, and all other foundational hardware.
2. POST. The CPU initializes itself and looks for a small program that is typically stored in a chip on the motherboard to get things started. The PC loads what’s called a Basic Input/Output System (BIOS-older PCs) or Unified Extensible Firmware Interface (UEFI-newer PCs). Notably, some manufacturers still call their UEFI software “BIOS.” (Firmware is a type of software that is embedded directly in a piece of hardware by the manufacturer to make the hardware work as intended.)
3. Load BIOS. The BIOS or UEFI firmware loads your custom configuration settings from a designated place on the motherboard. It also tests and initializes your system’s hardware, including the CPU itself.
4. OS load. After initializing hardware and checking for errors, the computer hands off control to a boot device such as a hard drive or solid-state drive. The boot device then loads the operating system into memory.
5. Transfer of control to OS. Once the operating system is loaded into memory, control is transferred to the OS, and it takes over from there.