The National Security Agency has issued a Cybersecurity Information Sheet detailing how organizations can address configuration challenges associated with Unified Extensible Firmware Interface—a.k.a. UEFI—Secure Boot.
The agency said Thursday that the guidance provides system owners with instructions on how to verify Secure Boot settings and detect or recover from misconfigurations.
Cyber has become a principal battlefield in global conflict and American systems are being targeted. Join the Potomac Officers Club’s 2026 Cyber Summit on May 21 to gain a better understanding of cyber from global adversaries and near-peer nations and get updates to ongoing and future cyber initiatives across the federal government. Get your tickets today.
What Are Secure Boot Vulnerabilities?
Secure Boot, introduced to the UEFI standard in the mid-2000s, restricts which software can run during the boot process. It blocks unsigned or unknown boot software while allowing many common operating system distributions.
However, over the years, experts have identified vulnerabilities affecting Secure Boot, emphasizing the need for accurate configuration across enterprise environments.
One vulnerability, BootHole, could enable malicious cyber actors to gain control of Linux systems during the boot process. NSA published mitigation options for the BootHole vulnerability in 2020.
The agency warned that Secure Boot is still widely used across modern devices, making it critical for organizations to assess their Secure Boot configurations and reduce their cyber risk.
What Does NSA Recommend?
The agency urged IT administrators and managers to review the guidance to confirm proper enforcement of Secure Boot policies.
NSA said organizations must not assume that their systems are secure with a Trusted Platform Module or full disk encryption tools like BitLocker.
Additionally, NSA encourages organizations to conduct acceptance testing of new devices to check if the Secure Boot is configured properly.
