Indlela yokuvuselela izitifiketi ze-Secure Boot ku-Windows futhi ugweme izinkinga zokuphepha

Informatec Digital » Izinsiza » Indlela yokuvuselela izitifiketi ze-Secure Boot ku-Windows futhi ugweme izinkinga zokuphepha

Uma usebenzisa i-Windows 10 noma i-Windows 11 futhi une -Secure Boot evuliwe , uthinteka ngqo yizinguquko zesitifiketi ezizokwenziwa abakhiqizi be-Microsoft kanye ne-PC phakathi kwamanje noJuni 2026. Lokhu akuyona inkinga yemfundiso: sikhuluma ngengxenye eqinisekisa ukuthi yini engasebenza emshinini wakho kusukela ngesikhathi ucindezela inkinobho yokuvula, kanye nezitifiketi zazo zokuqala ezizophelelwa yisikhathi.

Sekuyiminyaka sicabanga ukuthi uhlelo luvikelwe kusukela ngesikhathi luqala ngaso, kodwa manje sekuyisikhathi sokuhlola ukuthi konke sekulungele ukuvuselelwa kwesitifiketi se-Secure Boot . I-Microsoft, ama-OEM (njenge-Acer), kanye nabaphathi besistimu sebeqalile ukusebenza kukho, futhi kubalulekile ukuqonda okwenzekayo, imiphumela yokungenzi lutho, kanye nezinyathelo ezisebenzayo ongazithatha kungakhathaliseki ukuthi ungumsebenzisi wasekhaya noma uphatha amadivayisi amaningi enkampanini.

Kungani izitifiketi ze-Secure Boot ziphelelwa yisikhathi futhi kusho ukuthini?

Indlela ye -Secure Boot esekelwe ku-UEFI incike ezitifiketi zedijithali ezigcinwe ku-firmware ukuze kunqunywe ukuthi iyiphi ikhodi ethembekile ngesikhathi sokuqalisa: ama-boot loaders, abashayeli be-firmware, izingxenye ezibalulekile zesistimu yangaphambi kokusebenza, njll. Le modeli yaklanywa ngokuzungeza uhlu olubalulekile olusungula uchungechunge lokwethembana kusukela ku-firmware kuya ku-Windows.

Ngaphakathi kwalolu hlu lwezinhlelo, sithola, isibonelo, i- Platform Key (PK) , evame ukuvela ku-OEM (njenge-Acer), i- Key Exchange Keys (KEK) evela ku-Microsoft kanye nomkhiqizi, kanye nezizindalwazi ezimbili ezibalulekile: i-DB (amasignesha avunyelwe) kanye ne-DBX (amasignesha asusiwe). I-DB ifaka izitifiketi namasignesha abhekwa njengathembekile, kuyilapho i-DBX ibuyekezwa ngezinto okumele zivinjwe ngoba aziphephile noma ziye zaphazamiseka.

Izitifiketi zokuqala ze-Secure Boot ezikhishwe ngokubambisana yi-Acer ne-Microsoft zisukela ku- 2011 futhi zaklanywa ngokuphila cishe kweminyaka eyi-15. Lokhu kusho ukuthi lezi zitifiketi zokuqala zizofika osukwini lwazo lokuphelelwa yisikhathi ngoJuni 2026. Uma i-firmware yekhompyutha yakho isathembele kuzo futhi ingakabuyekezwa kuzitifiketi ezintsha zika-2023, ukuvikelwa kwe-boot kuzophelelwa yisikhathi.

Uma izitifiketi seziphelelwe yisikhathi, ikhompyutha ingase iqalise futhi isebenzise iWindows ngendlela evamile, kodwa inkinga ebalulekile ukuthi iMicrosoft ngeke ikwazi ukusebenzisa izindlela ezintsha zokunciphisa ijubane endaweni yokuqalisa. Lokhu kufaka phakathi ukuvikelwa ku-malware elayisha ngaphambi kwesistimu, imizamo yokudlula i-BitLocker, kanye nokunye ukuhlaselwa kochungechunge lokuqala lokwethembana.

Emishinini emidala, noma ezinhlelweni ezingasasekelwa (njengokufakwa kwe-Windows 10 ngaphandle kwe-ESU), ingozi igcina ngendawo yokuqalisa esebenza, kodwa ubuso bayo bokuhlasela buyanda ngoba ayitholi izibuyekezo zokuphepha ezifanayo noma ingasebenzisa ukuhoxiswa kwe-DBX yesimanje.

Umongo: ukuphela kokusekelwa kwe-Windows 10, ukuvela kwe-Windows 11, kanye nokuncika ku-Secure Boot

Isimemezelo sokuphela kokuphila kwe-Windows 10 sishukumisele izigidi zabasebenzisi ukuthi bathuthukele ku-Windows 11 ukuze bagweme ukulahlekelwa yizici zokuphepha. Namuhla, isabelo semakethe sishintshele ku-Windows 11 ngokusobala, cishe singu-63% uma kuqhathaniswa no-35% we-Windows 10, ikakhulukazi ngenxa yaleyo ngcindezi yokuphela kokusekelwa.

Nakuba ezinye izinhlelo ze-Windows 10 zisasebenzisa iziteshi ezikhethekile njengezinhlelo ze -LTSC noma ze-Extended Security Updates (ESU) , iqiniso liwukuthi abasebenzisi abaningi kuzodingeka baphile ndawonye ne-Windows 11 noma, okungenani, ngokusatshalaliswa kwe-Linux uma befuna ukuhlala bevikelekile. Kodwa lokho akusho ukuthi i-Windows 11 ayinakungeneka: ukusebenza kwezitifiketi ze-Secure Boot manje sekuqala ukusebenza ngqo.

Ku-Windows 11, i-Secure Boot akuyona into yokunethezeka, kodwa iyimfuneko yokufaka ezimweni eziningi ezisekelwayo. I-Microsoft iphikelela ekutheni ihlale ivuliwe hhayi nje kuphela ngenxa yokuphepha okuvamile, kodwa futhi ngoba izindlela eziningi zokunciphisa zincike kulolu chungechunge lokwethembana. Ngisho nasemhlabeni wemidlalo, kuvame kakhulu ukuthi izihloko zanamuhla (njengochungechunge lwe-Battlefield neminye imidlalo ye-AAA) zidinga ukuthi i-Secure Boot ivulwe ukuze isebenze.

Iqoqo lakamuva lezibuyekezo zokuphepha ze-Windows 11 lifaka phakathi ukujikeleziswa kwezitifiketi ze-Secure Boot eziphelelwa yisikhathi ngoJuni 2026. Abasebenzisi abaningi bazothola lezi zitifiketi ngokuzenzakalelayo nge-Windows Update, ngaphandle kokufuna ukusesha amafayela noma amaphakheji ngesandla.

Kumakhompyutha edeskithophu noma e-laptop athengwe kusukela ngo-2024-2025 kuqhubeke, abakhiqizi be-OEM sebevele bafake izitifiketi ze-UEFI CA 2023 ngqo kwi-firmware yabo, ngakho-ke lawa makhompyutha avela efektri ekulungele, futhi okudingeka ukwenze nje ukugcina iWindows isesikhathini futhi ungakhubazi i-Secure Boot ngokungadingekile.

Kwenzekani uma ungavuseleli izitifiketi zakho ze-Secure Boot?

Umbuzo ovame kakhulu ukuthi ngabe i-PC izoyeka yini ukuqala kabusha uma ifika osukwini lwayo lokuphelelwa yisikhathi. Impendulo, kubasebenzisi abaningi, ukuthi ikhompyutha izoqhubeka nokuvula nokusebenza ngendlela evamile. Uzokwazi ukuvula izinhlelo zakho zokusebenza, uphequlule i-inthanethi, futhi usebenzise uhlelo lokusebenza njengoba wenza manje.

Inkinga yangempela iyinkimbinkimbi kakhulu: ikhompyutha enezitifiketi ze-Secure Boot eziphelelwe yisikhathi ingase iyeke ukuthola noma ukusebenzisa kahle izibuyekezo ezithile ezidinga lolu chungechunge olusha lokwethenjwa. Ezinye izithuthukisi ezibalulekile zokuphepha ezingeni le-boot zingase zingafakwa, okudala ubuthakathaka abahlaseli abangabusebenzisa kabi.

Ngaphezu kwalokho, lokhu kuvuselelwa kwezitifiketi kuklanyelwe ukubhekana nobuthakathaka besimanje endaweni yangaphambi kohlelo lokusebenza. Uma isisekelo sezitifiketi singabuyekezwa, i-PC ingaba yisisulu esilula se-malware ye-bootkit, ama-rootkit aqhubekayo, noma amathuluzi aklanyelwe ukudlula izindlela ezifana ne-BitLocker ezigabeni zokuqala zokuqalisa.

Kunesinye isimo okufanele sicatshangelwe: ezinye izinhlelo zokusebenza, ikakhulukazi ezindaweni zezinkampani noma zokuphepha okuphezulu, zingadinga ukuthi i-Secure Boot isebenze futhi ibuyekezwe . Uma ukuhlolwa kwangaphakathi kuthola izitifiketi eziphelelwe yisikhathi, kungase kwenqabe ukusebenza noma kube nokusebenza okulinganiselwe, okuthinta umkhiqizo.

Ngakho-ke, isincomo seMicrosoft sicacile: hlala uvula i-Secure Boot futhi uyibuyekeza , faka izibuyekezo zakamuva ze-Windows 11 noma, uma kwenzeka ku-Windows 10 nge-ESU, sebenzisa wonke ama-patches okuphepha, futhi uqiniseke ukuthi unenguqulo yakamuva ye-firmware/BIOS etholakalayo kukhompyutha ngayinye.

Ungahlola kanjani isimo sezitifiketi ze-Secure Boot ku-Windows

Ukuze uthole ukuthi umshini wakho usuvele wamukele izitifiketi ezintsha ze-Secure Boot , ungenza ukuhlola okusheshayo usebenzisa i-PowerShell. I-Microsoft inikeza umyalo ohlola okuqukethwe yi-database ye-Secure Boot signature (db) futhi ubheke ngqo ukuba khona kwe -Windows UEFI CA 2023.

Njengoba i-PowerShell ivuliwe ngamalungelo okuphatha, ungasebenzisa into efana nalokhu:

([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023')

Uma umyalo ubuya ne -True , kusho ukuthi ikhompyutha isivele isebenzisa isitifiketi esisha se-UEFI sika-2023 futhi ivikelwe ekuphelelweni yisikhathi kwezitifiketi zokuqala zika-2011. Uma kunjalo, akudingeki ukhathazeke ngaphandle kokuqhubeka nokusebenzisa izibuyekezo ezijwayelekile ze-Windows kanye ne-firmware uma sezitholakala.

Ngakolunye uhlangothi, uma inkulumo ibuya i-False , umshini usathembela ezitifiketini eziphelelwa yisikhathi ngoJuni 2026. Kuleso simo, kungcono ukuthi uqale uhlole ukuthi i-Secure Boot ivuliwe yini ku-BIOS/UEFI, bese uphoqa noma wenze kube lula ukufika kwezibuyekezo ezidingekayo nge-Windows Update noma ngokucushwa okufanele ezindaweni eziphethwe.

Ukuze uqinisekise ukuthi i-Secure Boot ivuliwe, ungasebenzisa ithuluzi le-System Information elinomyalo othi msinfo32 . Efasiteleni elivulayo, hlola insimu ehambisana ne-"Secure Boot Status": uma ithi "Ivuliwe," isici siyasebenza; uma ithi "Ikhubazekile" noma "Ayisekelwa," kuzodingeka ufinyelele izilungiselelo ze-UEFI zebhodi lomama noma i-laptop ukuze uyivule, uma nje ihadiwe ivumela.

Uma, ngemva kokuhlola i-msinfo32 kanye nomyalo we-PowerShell, ungakaboni isitifiketi sika-2023, isinyathelo esilandelayo esinengqondo yi- Windows Update . Hlola izibuyekezo ezisalindile, ikakhulukazi lezo ezihlukaniswe njengezibuyekezo zokuphepha noma ze-firmware. Emishinini eminingi, ukufaka nje la maphakheji nokuqala kabusha kuzosebenzisa ngokuzenzakalelayo ukuvuselelwa kwesitifiketi.

Ukuvuselelwa ngesandla kwezitifiketi ze-Secure Boot kumakhompyutha ngamanye

Kunezimo lapho, naphezu kokuba i-Secure Boot ivuliwe futhi i-Windows Update isebenza, isibuyekezo sedathabheyisi yesitifiketi asisebenzi ngokuzenzakalelayo. Kulezi zimo, i-Microsoft ichaza indlela yokuphoqa ukusayinwa kwesibuyekezo nge-Windows Registry.

Inqubo ejwayelekile ihilela ukudala noma ukuguqula inani le -AvailableUpdates egatsheni lokubhalisa elinikezelwe ku-Secure Boot. Ku-PowerShell enamalungelo okuphatha, umyalo ofana nolandelayo ungasetshenziswa:

reg add HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/Secureboot /v AvailableUpdates /t REG_DWORD /d 0x5944 /f

Kubalulekile ukuqaphela ukuthi uma unamathisela lo myalo ku-PowerShell, kufanele ufake ama-forward slashes "/" endleleni yokubhalisa ngama -Windows backslashes ajwayelekile ukuze umyalo usebenze kahle. Uma leli nani selidaliwe noma selilungisiwe, i-Windows kufanele ibone ukuthi izibuyekezo zesitifiketi ziyatholakala bese izisebenzisa ngemva komjikelezo olandelayo we-Windows Update bese iqala kabusha.

Ngaphambi kokushintsha iRegistry, kuyalulekwa ukuqinisekisa ukuthi uhlelo lwakho luhlangabezana nezidingo eziyisisekelo: I-Secure Boot ivuliwe ku-BIOS, inguqulo esekelwayo yeWindows (ikakhulukazi iWindows 11 noma iWindows 10 ene-ESU), kanye nensizakalo ye-Windows Update esebenza. Noma yiziphi izinguquko ezingalungile kuRegistry zingabangela izinkinga, ngakho-ke kungumqondo omuhle ukuba ne-backup noma i-system restore point.

Uma inqubo isiqediwe futhi ngemva kokuqala kabusha okukodwa noma ngaphezulu, ungaphinda usebenzise umyalo we-PowerShell osesha i-“Windows UEFI CA 2023” kusizindalwazi se-Secure Boot. Uma impendulo iyiqiniso kulokhu, umshini manje usebenza nezitifiketi ezivuselelwe , futhi izindlela zokunciphisa ukuqalisa zesikhathi esizayo zingasetshenziswa ngaphandle kwenkinga.

Ukuqapha okuthuthukisiwe: imicimbi, ukuloga, kanye ne-WMI yabaphathi

Ezindaweni zebhizinisi, iMicrosoft itusa ukudlulela ngale kokuqinisekiswa ngesandla ngemiyalo embalwa. Ukuze uqonde ukuthi ithimba ngalinye limi kuphi mayelana nokubuyekezwa kwesitifiketi se-Secure Boot , kubalulekile ukubuyekeza imicimbi yesistimu nokuqoqa ulwazi oluningiliziwe usebenzisa i-PowerShell, irejista, kanye nemibuzo ye-WMI/CIM.

Isinyathelo sokuqala ukuhlola imicimbi yakamuva ye-Secure Boot , ikakhulukazi izihlonzi 1801 kanye no-1808. Le micimbi ibhalwe phansi njengengxenye yamalogi ahlotshaniswa nesizindalwazi se-Secure Boot (db) kanye nezibuyekezo zesizindalwazi sokuhoxiswa (DBX). Ukuhlaziya imicimbi yakamuva kusiza ekunqumeni ukuthi kukhona yini izibuyekezo ezisalindile, amaphutha ohlelo lokusebenza, noma izimo zempumelelo.

Ngaphezu kwalokho, kunconywa ukwenza uhlu oluningiliziwe lwamadivayisi kuyo yonke inhlangano. Izikripthi ze-PowerShell zingasetshenziswa ukuqoqa amapharamitha afana negama lomshini (i-HostName, isibonelo, i-$env:COMPUTERNAME) kanye nosuku nesikhathi sokuqoqa (i-Get-Date), okunikeza isithombe esicacile seqembu lemishini ngesikhathi esithile.

Kusukela ku-Registry, kunezinkinobho eziningana ezifaneleke kakhulu. Esinye yikhiye eyinhloko ye-Secure Boot etholakala ku -HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot , lapho amanani afana ne-SecureBootEnabled, i-HighConfidenceOptOut, kanye ne-AvailableUpdates angahlolwa khona. Le datha ikhombisa ukuthi i-Secure Boot iyasebenza yini, ukuthi idivayisi ikhethe ukusebenzisa izinqubomgomo ezithile zokuthembela, nokuthi izibuyekezo zesitifiketi ziyatholakala yini.

Ngakolunye uhlangothi, kukhona igatsha lokulungisa ku- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing , equkethe amapharamitha afana ne-UEFICA2023Status, i-WindowsUEFICA2023Capable, kanye ne-UEFICA2023Error. Lawa manani abonisa ukuthi idivayisi iyakwazi yini ukwamukela izitifiketi ezintsha ze-UEFI CA 2023, ukuthi izisebenzisile yini, nokuthi ngabe kukhona amaphutha avele ngesikhathi senqubo.

Isigaba sezimfanelo zedivayisi, i-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing\DeviceAttributes , siwusizo futhi. Lesi sigaba sigcina idatha efana ne-OEMManufacturerName, i-OEMModelSystemFamily, i-OEMModelNumber, i-FirmwareVersion, i-FirmwareReleaseDate, i-OSArchitecture, kanye ne-CanAttemptUpdateAfter. Lolu lwazi lusiza ukuhambisana kwe-firmware ehambisanayo nesimo sezibuyekezo ze-Secure Boot.

Ngokuphathelene namalogi emicimbi, kuyalulekwa ukuqoqa izinkomba ezifana ne- LatestEventId ehlotshaniswa ne-Secure Boot, i-BucketID, kanye nezinga lokuthembela elithathwe kumicimbi engu-1801/1808, kanye nezibalo ze-Event1801Count kanye ne-Event1808Count. Ngale telemetry, amaqembu e-IT angathola amaphethini, amaphutha aphindaphindayo, noma amadivayisi angalokothi aqede ngempumelelo izibuyekezo zesitifiketi.

Ekugcineni, imininingwane eyengeziwe yesistimu itholakala kusetshenziswa imibuzo ye-WMI/CIM : inguqulo ye-Windows (Get-CimInstance Win32_OperatingSystem ye-OSVersion kanye ne-LastBootTime), umkhiqizi webhodi lomama kanye nomkhiqizo (Get-CimInstance Win32_BaseBoard), umkhiqizi wekhompyutha kanye nomodeli (Get-CIMinstance Win32_ComputerSystem).Manufacturer kanye ne-.Model), kanye nedatha ye-BIOS (Get-CIMinstance Win32_BIOS yencazelo kanye nosuku lokukhishwa). Konke lokhu kuvumela ukuhlangana kwezinguqulo ze-firmware, ihadiwe, kanye nesimo se-Secure Boot ngaphakathi kwempahla eyodwa.

Izindawo ezilawulwa ngobuhlakani kanye namadivayisi alawulwa yi-IT

Ezinhlanganweni ezisebenzisa i-Intune noma ezinye izixazululo ze-MDM ukuphatha amadivayisi azo e-Windows, umbuzo obalulekile ukuthi kwanele yini ukuvumela i-Windows Update ukuthi yenze umsebenzi wayo noma uma kudingeka kuthathwe izinyathelo ezengeziwe ngaphambi kuka-2026. I-Microsoft ibonise ukuthi, ezindaweni ezilawulwayo, inqobo nje uma idatha yokuxilonga ivuliwe okungenani ezingeni "Elidingekayo", izibuyekezo ezidingekayo zizolethwa ngokuzenzakalelayo.

Empeleni, lokhu kusho ukuthi uma izinqubomgomo zakho ze-Intune sezivele zivumela i-telemetry futhi izinketho zakho zokubuyekeza zilungiselelwe kahle, ungaphumula. Noma kunjalo, abaphathi abaningi bayazibuza ukuthi kufanele yini badale ngesandla okhiye abathile bokubhalisa, njenge-MicrosoftUpdateManagedOptIn, noma ukuthi lezi zilungiselelwa ngokuzenzakalelayo uma idivayisi ihlangabezana nezidingo.

I-Microsoft ishicilele amadokhumenti athile abonisa ukuthi ukhiye we -MicrosoftUpdateManagedOptIn , otholakala ku-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot, kumele usethelwe ku-1 kumadivayisi anezibuyekezo ezilawulwa yi-IT ukuze ukuvuselelwa kwesitifiketi okuzenzakalelayo kusebenze kahle. Kwezinye izimo, lo khiye ungalungiselelwa ngokuzenzakalelayo, kodwa kwezinye, kungadingeka ukuwuphoqelela ngezinqubomgomo.

Ngakho-ke, isincomo siwukubuyekeza izinqubomgomo ze-Intune ezihlobene nokuxilonga kanye nezibuyekezo, ukuqinisekisa isimo sangempela semishini esebenzisa izikripthi zempahla, futhi, uma kudingeka, kusetshenziswe inqubomgomo yokucushwa eqinisekisa ukuthi i-MicrosoftUpdateManagedOptIn inenani elifanele nokuthi amagatsha e-Servicing abonisa ukuhambisana ne-UEFI CA 2023.

Kubaluleke ngokulinganayo ukungacabangi ngokungacabangi ukuthi "akukho okuzodingeka kwenziwe ngo-2026." Nakuba iMicrosoft yenza ingxenye enkulu yenqubo ibe ngokuzenzakalela, yonke inhlangano inezici zayo ezihlukile: amadivayisi ane-firmware esidala, amakhompyutha angaxhumani njalo, izinqubomgomo zenethiwekhi ezivimbelayo, noma imishini enezibuyekezo ezihlehlisiwe. Uhlelo lokuqinisekisa olusebenzayo luvimbela izimangaliso zomzuzu wokugcina.

Indima yama-OEM kanye nezibuyekezo ze-BIOS/firmware

Abakhiqizi bamakhompyutha kanye nama-motherboard, njenge-Acer, badlala indima ebalulekile kulo lonke lolu hlelo. Balawula i -Platform Key (PK) kanye namanye ama-KEK atholakala ku-firmware, kanye nezinguqulo ze-BIOS/UEFI ezinquma ukuthi izizindalwazi ze-Secure Boot DB kanye ne-DBX zilayishwa futhi ziphathwa kanjani.

Ngokusho kwe-Acer, inkampani ihlela ukukhipha izibuyekezo ze-BIOS ngqo kuma-laptop nama-desktop athintekile kwikota yokuqala ka-2026. Lezi zinguqulo zifaka phakathi i-PK, i-KEK, kanye ne-DB ezibuyekezwe ngezitifiketi zika-2023, ukuze ngemva kokusebenzisa i-BIOS, ikhompyutha ihambisane nochungechunge olusha lwe-Secure Boot of trust.

Amanye ama-OEM cishe azolandela amasu afanayo, ngakho-ke abaphathi be-IT nabasebenzisi abathuthukile kufanele banake kakhulu amanothi okusekela abakhiqizi babo . Ezimweni eziningi, inqubo izohilela ukulanda i-BIOS entsha kuwebhusayithi ye-OEM noma ukuyithola ngamathuluzi ayimfihlo (njengezinsiza zokuvuselela okuzenzakalelayo) nokusebenzisa isibuyekezo ngokulandela imiyalelo ejwayelekile.

Kumakhompyutha akhishwe ngo-2024 noma ngo-2025, i-BIOS ivame ukuza nezihluthulelo ze-BIOS ezingu-2023 ezivela efektri, noma ithole leso sibuyekezo ngemuva nje kokuthenga. Uma uthenge i-PC yakho ngaleyo minyaka, cishe usuvele unazo izitifiketi ezibuyekeziwe ; noma kunjalo, ukuhlolwa kwe-PowerShell kuhlale kungumqondo omuhle ukuqinisekisa.

Uma kwenzeka ingqalasizinda esatshalaliswe, izikhungo zedatha, noma ama-laptop amakhulu, kungadingeka ukuhlanganisa uhlelo lokufakwa kwe-firmware oluhlukaniswe ngezigaba nama-OEM , kugwenywe ukusebenzisa izibuyekezo ezibalulekile ze-BIOS kuwo wonke amadivayisi ngesikhathi esisodwa ngaphandle kokuhlola kwangaphambilini. Lokhu kuhlanganiswe nokuphathwa komjikelezo wokuphila we-cryptographic kanye ne-firmware osekuqalisiwe yizinkampani eziningi kakade.

Izindlela ezinhle kakhulu zokuphepha kwe-inthanethi eziphathelene ne-Secure Boot

Ukuvuselela izitifiketi ze-Secure Boot akuyona into eyenzeka yodwa, kodwa kuyingxenye yokuphatha umjikelezo wokuphila we-cryptographic wenhlangano . Ukuhlela ukujikeleziswa kwezikhiye nezitifiketi, ukuhlola ukuthi yini esetshenziswayo empeleni endaweni ezungezile, nokugcina izilawuli zobuqotho ku-firmware kanye ne-TPM kunciphisa amathuba okuba othile aphazamise uhlelo ngesikhathi sezigaba zokuqala zokuqalisa.

Kulokhu, kuyalulekwa ukuhlanganisa izilawuli zokuqalisa nezinye izendlalelo zokuvikela: ukubethela idiski kusetshenziswa i-BitLocker , izinhlelo zokuthola nokuphendula (i-EDR/XDR), ukuqapha izinguquko ze-firmware kanye nokucushwa, kanye nokubuyekezwa okuvamile kwezinqubomgomo zokuphepha ze-Windows kanye nehadiwe. Konke lokhu kusiza ukuvimbela ukwehluleka okukodwa kwesendlalelo esisodwa ukuthi kungafaki engcupheni uhlelo lonke.

Izinkampani ezigxile ekuphepheni kwe-cyber kanye nokuhlolwa kokungena zinganezela inani ngokwenza ukuhlolwa kwe-boot chain , ukulingisa ukuhlaselwa kwe-firmware, i-UEFI, kanye ne-Secure Boot uqobo, nokuqinisekisa ukuthi ukuzivikela kuziphatha njengoba kulindelekile. Lezi zinsizakalo zivame ukufaka nezincomo zokwenza ngokuzenzakalela nokuhlela izibuyekezo.

Ezinhlanganweni ezinezingqalasizinda ezisabalele kakhulu, ukusebenzisa izinsizakalo zamafu njenge -Azure noma i-AWS ukusetha iziteshi zokusabalalisa kanye nokuphathwa kokuvuselelwa okuhlanganisiwe kungenza kube lula ukulawula ama-patches, izitifiketi, kanye ne-firmware. Ngaphezu kwalokho, ukusebenzisa amadeshibhodi ku-Power BI kanye nokuhlaziywa kwe-telemetry kusiza ukubeka phambili ukuthi yimaphi amadivayisi adinga ukunakwa okuphuthumayo.

Ukusetshenziswa kwamathuluzi obuhlakani bokwenziwa kanye nokutholwa kwe-anomaly okugxile kwimicimbi yokuqalisa kanye nokuziphatha kwe-firmware kuya ngokuya kuvama. Lezi zinhlelo zingathola amaphethini angavamile kuma-Secure Boot logs, ukuqalisa kabusha okungavamile, noma ukuguqulwa kokucushwa kwe-UEFI okungabonisa ukuzama ukuhlasela noma ukulungiselelwa okungalungile.

Ezingeni lokusebenza, ezinye izincomo eziyisisekelo zifaka: ukuhlola njalo i-Windows Update kanye nezimo zokuphepha ku-Windows Security Center, ukucela i-firmware esemthethweni kubakhiqizi bemishini engavuseleli ngokuzenzakalelayo, ukuhlola izibuyekezo kuma-lab ngaphambi kokufakwa kwenqwaba, kanye nokugcina izinto ezikhona zisesikhathini kanye nezinhlelo zokuphatha ama-patch ezilungiselelwe kahle.

Ukuhlanganisa le mikhuba nokuvuselelwa okufanele kwezitifiketi ze-Secure Boot kusiza ukugcina isimo sokuphepha esiqinile, kunciphisa amathuba okudalulwa futhi kusiza ekuhlolweni kwesikhathi esizayo, kungaba ngaphakathi noma ngaphandle.

Ngamafuphi, ukuphelelwa yisikhathi kwezitifiketi ze-Secure Boot ngoJuni 2026 kwenza kube kubalulekile ukubuyekeza indlela izinhlelo zethu ezihlelwe futhi zibuyekezwa ngayo, kokubili ekhaya nasezinhlanganweni ezinkulu: ukuqinisekisa ukuthi i-Secure Boot iyasebenza , ukuqinisekisa ukuba khona kwe-Windows UEFI CA 2023 evela ku-PowerShell, ukuqinisekisa okhiye bokubhalisa kanye nemicimbi, ukuxhumanisa nama-OEM ukusebenzisa i-firmware yakamuva, kanye nokusebenzisa amakhono ezixazululo ze-Intune, i-WSUS, i-SCCM, noma i-MDM ukuze kusetshenziswe ngokuzenzakalelayo ukuthunyelwa kwenza umehluko omkhulu phakathi kwendawo ehlala ivikelwe ezinsongweni zesimanje ze-boot kanye naleyo, yize ibonakala ijwayelekile, eqoqa izingozi ezithule okunzima ukuzithola ekuqaleni.