Can someone explain in simple terms what TPM (Trusted Platform Module) and Secure Boot are, and how they protect my computer? I'm curious about what kind of security I get when I turn on my device. For instance, can these features prevent a hacker from accessing my computer at the BIOS level, and stop any malware from activating during startup? I realize that you typically need an internet connection to infect a computer, but if I were to download a virus while using my PC, would it still need a restart to activate? Would the BIOS be able to detect something's off and stop my system from booting? I'm just trying to understand if this is really about securing the BIOS, the running system, or both.
2 Answers
Secure Boot is designed to prevent unauthorized software from loading before your OS does. If something does manage to insert itself, then it can manipulate the OS. Think of it as protecting the foundation of your computer. So, while Secure Boot helps in securing the boot process, it doesn’t protect an already running OS from infections.
Essentially, a TPM itself doesn't protect against viruses in the way you're thinking. It’s mainly used to store encryption keys and validate booting. So, if you don’t use features like BitLocker, you might not find much use for it, but turning it off isn’t necessary unless you want to.
So, if I only have Windows 10 Home without BitLocker, is TPM kind of pointless for me? Should I just keep it enabled or is it better to turn it off?
So, if I have Secure Boot enabled, will my OS check if all system drivers are okay each time I start? If I get a virus or bad drivers while using my OS, will Secure Boot prevent the system from starting again?