Windows 10: Secure boot: practice and experience?

I'm running win10-1909 on a 'system build' desktop PC, meaning it's a bitsa everything, modified over time by the local computer store or me to suit various needs as they arose (eg, a replacement m/b after the old one failed, extra RAM, additional internal HDD, a LAN enabling the desktop and several laptops to access the internet modem, network attached stores, etc). The motherboard is a Gigabyte unit, 5 years old, with 1x250gb SSD, and 3x 500gb HDD installed internally (the SSD is the C drive) and I recently (June 20) upgraded from win7. The BIOS is UEFI compatible, but currently set for 'UEFI and legacy'.

After a full scan of the PC with Defender, I noted a remark in the results about 'no secure boot' which led me to read number of articles and tutorials about secure boot. Many of the latter cited specific brands in the discussion - which doesn't apply in my case. A close friend and guru is very wary of 'secure boot' and does not use it, because he says a corruption of the boot keys means a boot failure and any of the drives data is inaccessible. On a PC where all the data is on C, a failure to boot would make it inaccessible, but that doesn't mean that it's encrypted or would be inaccessible if it was on separate drives and C was recovered.

Contemplating a secure mode conversion, this post is soliciting advice and the experience of others re secure boot use on a number of issues I can foresee.

1. PC's meeting MS windows 10 "certification" must be configured for secure boot, usually done by the manufacturer as part of the OS pre-installation process.
Q: Has anyone had any issues with the boot on a new PC in this mode???
2. Implementing secure boot uses public key crypto technology - reasonably reliable since banking and eftpos usage relies on it. A digital signature of a file is crypto derived without encrypting the source they apply to. Getting the keys for that process and keeping them secure in the BIOS would be the major issues. A UEFI BIOS supposedly has a separate key storage module: keeping various digital signature keys in that store between manufacture and use does seem to be a risk. Yet the keys have to be available whenever a secure boot is configured.
Q: So, how are the keys delivered for a the very first secure boot configuration and use?
3. A pre-condition of a secure mode conversion is the selection of a UEFI only BIOS mode, which makes a complete re-install of the OS ("clean" at this stage being the only option) a necessity. A review of the UEFI specs on wikipedia and general commentary on usage seems to indicate that it's unduly complicated, with most features simply unused on a PC.
Q: Digital signatures are not related to the method of storage, so just what is so special about UEFI - as opposed to MBR - use in a PC that dictates it's use for a secure boot?
4. Doing a secure boot implementation when a motherboard is replaced - and the OS has to be fully re-installed - would be the best time to do this.
Q: Is just a) choosing UEFI only, and 2) selecting a secure mode boot in the BIOS (before booting from the OS installation disk or usb) all that is necessary for it to happen?
5. General experience with secure mode. The bootkit hazard that MS outlines as the reason for secure mode has not had a lot of press;
Q: Is secure mode as reliable as MBR methods are? Or have secure mode users had issues and had to revert to the traditional MBR means?

:)

 

Secure boot: practice and experience?

I'm running win10-1909 on a 'system build' desktop PC, meaning it's a bitsa everything, modified over time by the local computer store or me to suit various needs as they arose (eg, a replacement m/b after the old one failed, extra RAM, additional internal HDD, a LAN enabling the desktop and several laptops to access the internet modem, network attached stores, etc). The motherboard is a Gigabyte unit, 5 years old, with 1x250gb SSD, and 3x 500gb HDD installed internally (the SSD is the C drive) and I recently (June 20) upgraded from win7. The BIOS is UEFI compatible, but currently set for 'UEFI and legacy'.

After a full scan of the PC with Defender, I noted a remark in the results about 'no secure boot' which led me to read number of articles and tutorials about secure boot. Many of the latter cited specific brands in the discussion - which doesn't apply in my case. A close friend and guru is very wary of 'secure boot' and does not use it, because he says a corruption of the boot keys means a boot failure and any of the drives data is inaccessible. On a PC where all the data is on C, a failure to boot would make it inaccessible, but that doesn't mean that it's encrypted or would be inaccessible if it was on separate drives and C was recovered.

Contemplating a secure mode conversion, this post is soliciting advice and the experience of others re secure boot use on a number of issues I can foresee.

1. PC's meeting MS windows 10 "certification" must be configured for secure boot, usually done by the manufacturer as part of the OS pre-installation process.
Q: Has anyone had any issues with the boot on a new PC in this mode???
2. Implementing secure boot uses public key crypto technology - reasonably reliable since banking and eftpos usage relies on it. A digital signature of a file is crypto derived without encrypting the source they apply to. Getting the keys for that process and keeping them secure in the BIOS would be the major issues. A UEFI BIOS supposedly has a separate key storage module: keeping various digital signature keys in that store between manufacture and use does seem to be a risk. Yet the keys have to be available whenever a secure boot is configured.
Q: So, how are the keys delivered for a the very first secure boot configuration and use?
3. A pre-condition of a secure mode conversion is the selection of a UEFI only BIOS mode, which makes a complete re-install of the OS ("clean" at this stage being the only option) a necessity. A review of the UEFI specs on wikipedia and general commentary on usage seems to indicate that it's unduly complicated, with most features simply unused on a PC.
Q: Digital signatures are not related to the method of storage, so just what is so special about UEFI - as opposed to MBR - use in a PC that dictates it's use for a secure boot?
4. Doing a secure boot implementation when a motherboard is replaced - and the OS has to be fully re-installed - would be the best time to do this.
Q: Is just a) choosing UEFI only, and 2) selecting a secure mode boot in the BIOS (before booting from the OS installation disk or usb) all that is necessary for it to happen?
5. General experience with secure mode. The bootkit hazard that MS outlines as the reason for secure mode has not had a lot of press;
Q: Is secure mode as reliable as MBR methods are? Or have secure mode users had issues and had to revert to the traditional MBR means?

 

Secure boot: practice and experience?

I have an SI PC (Acer Predator 8th gen i5-8400/ B360 board) bought September 2018, since day 1 it has been configured UEFI + Secure Boot.
It originally came supplied with an Intel Optane 16Gb module paired with a 1Tb Seagate Barracuda drive (spinning rust) and Windows 10 Home OEM (1903 I believe).
Between purchase and today I have doubled the RAM (2x Completely new kits), replaced the Optane with an NVME drive to boot from, replaced the 1Tb spinner with a 500Gb SSD and added a third SSD (having removed the , to my way of thinking, totally pointless DVD drive).
The BIOS has been updated 5 times (mostly for CPU support/ security upgrades, ME firmware updates/ mitigations), Windows has been upgraded to Pro retail and has gone from 1903 - 1909 - 2004.
I have used the MS feature updates through Windows update and also clean installed a couple of times.
I regularly use Macrium Reflect Free (and have since day one) to create system images and have used the Macrium boot USB from time to time.
All these changes and updates have occurred with Secure boot active at all times, never needed to disable it, it just works invisibly with my setup.
That is my experience with Secure boot so far.

 

Internet Security

IMO lots depends on the habits and the knowledge of the computer user...

Suggestion to read:

• Choosing an Anti-Virus Program
• Safe Steps for Replacing your Anti-virus - Why should you use Antivirus
  software?
• Supplementing your Anti-Virus Program with Anti-Malware Tools
• Best Practices for Safe Computing - Prevention of Malware Infection
  

Suggestion to watch: