How Computers Work · Starting Up · Lesson 2 of 5

BIOS, UEFI and Secure Boot

The program that runs before Windows, and how it blocks fake startup code.

The computer's first program

Before Windows can run, something has to wake up the hardware. That job belongs to the firmware. Firmware is software stored on a chip on the main board, so it is there even with no drive inside.

For decades, PC firmware was called the BIOS, short for Basic Input/Output System. It was simple and old fashioned. Modern PCs use UEFI instead, short for Unified Extensible Firmware Interface. UEFI is the newer, more capable replacement. It starts faster, works with large drives and supports Secure Boot. Many people still say BIOS out of habit, and they usually mean UEFI.

The firmware has a settings screen. It holds choices like these:

• Boot order, the list of drives the computer tries to start from, in order.
• Secure Boot, which can be on or off.
• TPM, a security chip you will meet in the next module.

The easiest way in on Windows 11:

1. Open Settings > System > Recovery.
2. Next to Advanced startup, select Restart now.
3. Choose Troubleshoot > Advanced options > UEFI Firmware Settings, then Restart.

Some PCs also open it if you press a key like F2 or Delete right after power on. The key depends on the maker.

A careful rule: look, but don't change settings you don't understand. A wrong change can stop the computer from starting. If you change something by mistake, exit without saving.

On the practice computer, find the boot order, Secure Boot and the TPM. Then exit without saving.

Secure Boot and bootkits

The startup chain has a weak spot. Code that runs before Windows also runs before your antivirus. If an attacker sneaks code in there, it can hide from almost everything.

That kind of malware is called a bootkit. It replaces or changes the boot loader, so it loads first and controls what comes after. A bootkit can survive restarts and can be very hard to remove.

Secure Boot is a UEFI feature that blocks this. It works with digital signatures. A digital signature is a code stamp that proves who made a program and that nobody changed it since.

Here is how it works:

1. The firmware holds a list of trusted signers, such as Microsoft and the PC maker.
2. Before running the boot loader, the firmware checks its signature.
3. If the signature is valid and trusted, the boot loader runs.
4. If it is missing or wrong, the firmware refuses to run it.

Windows then keeps checking each next piece as it loads. Each step checks the one after it. This is called a chain of trust.

Some practical points:

• Windows 11 requires a PC that is Secure Boot capable.
• Leave Secure Boot on. A guide or stranger telling you to turn it off is a warning sign.
• If Windows says there is a Secure Boot problem, restart first, then ask for help before changing settings.

Phones do the same thing. iPhones and Android phones check signatures at every startup step too.

On a Mac with Apple silicon, startup security is always built in. You rarely need to touch it.