Copyright
©
2016
congatec
AG
ICSLm13.indd
89/95
8.6.1.1
BIOS Security Features
BIOS Password/ BIOS Write Protection
A BIOS password protects the BIOS setup program from unauthorized access. This ensures that end users cannot change the system configuration
without authorization. With an assigned BIOS password, the BIOS prompts the user for a password on a setup entry. If the password entered
is wrong, the BIOS setup program will not launch.
The congatec BIOS uses a SHA256 based encryption for the password, which is more secured than the original AMI encryption. The BIOS
password is case sensitive with a minimum of 3 characters and a maximum of 20 characters. Once a BIOS password has been assigned, the
BIOS activates the disabled ‘BIOS Update and Write Protection’ option. If this option enabled, only authorized users (users with the correct
password) can update the BIOS. To update the BIOS, use the congatec system utility cgutlcmd.exe with the following syntax:
CGUTLCMD BFLASH <BIOS file> /BP: <password> where <password> is the assigned BIOS password.
For more information about “Updating the BIOS” refer to the congatec system utility user’s guide, which is called CGUTLm1x.pdf and can be
found on the congatec AG website at www.congatec.com.
With the BIOS password protection and the BIOS update and write protection, the system configuration is completely secured. If the BIOS is
password protected, you cannot change the configuration of an end application without the correct password.
Note
Use cgutlcmd.exe version 1.5.3 or later.
Built in BIOS recovery is disabled in the congatec BIOS firmware to prevent the BIOS from updating itself due to the user pressing a special
key combination or a corrupt BIOS being detected. congatec considers such a recovery update a security risk because the BIOS internal
update process bypasses the implemented BIOS security explained above.
Only the congatec utility interface to the SMI handler of the BIOS flash update is enabled. Other interfaces to the SMI handler are disabled
to prevent non congatec tools from writing to the BIOS flash. Because of this restriction, flash utilities supplied by AMI or Intel will not work .
UEFI Secure Boot
Secure Boot is a security standard defined in UEFI specification 2.3.1 that helps prevent malicious software applications and unauthorized
operating systems from loading during system start up process. Without secure boot enabled (not supported or disabled), the computer
simply hands over control to the bootloader without checking whether it is a trusted operating system or malware. With secure boot supported
and enabled, the UEFI firmware starts the bootloader only if the bootloader’s signature has maintained integrity and also if one of the following
conditions is true:
