IT Security 
IT Security Meta
Camil Staps asked this question back in April 2013, as although it is generally accepted that using a BIOS password is good practice, he couldn’t see what protection this would provide, given, in his words, “…there aren’t really interesting settings in the BIOS, are there?”
While Camil reckoned that the BIOS only holds things like date and time, and enabling drives etc., the answers and comments point out some of the risks, both in relying on a BIOS password and in thinking the BIOS is not important!
The accepted answer from Iszi covers off why the BIOS should be protected:
…an attacker to bypass access restrictions you have in place on any non-encrypted data on your drives. With this, they can:
- Read any data stored unencrypted on the drive.
- Run cracking tools against local user credentials, or download the authenticator data for offline cracking.
- Edit the Registry or password files to gain access within the native OS.
- Upload malicious files and configure the system to run them on next boot-up.
And what you should do as a matter of course:
That said, a lot of the recommendations in my post here (and other answers in that, and linked, threads) are still worth considering.
- Encrypt the hard drive
- Make sure the computer is physically secure (e.g.: locked room/cabinet/chassis)
- Use strong passwords for encryption & BIOS
Password-protecting the BIOS is not entirely an effort in futility.
Thomas Pornin covers off a possible reason for changing the date:
…by making the machine believe it is in the far past, the attacker may trigger some other behaviour which could impact security. For instance, if the OS-level logon uses smart cards with certificates, then the OS will verify that the certificate has not been revoked. If the attacker got to steal a smart card with its PIN code, but the theft was discovered and the certificate was revoked, then the attacker may want to alter the date so that the machine believes that the certificate is not yet revoked.
But all the answers agree that all a BIOS password does on its own is protect the BIOS settings – all of which can be bypassed by an attacker who has physical access to the machine, so as per Piskvor‘s answer:
you need to set up some sort of disk encryption (so that the data is only accessible when your system is running)
Like this question of the week? Interested in reading more detail, and other answers? See the question in full. Have questions of a security nature of your own? Security expert and want to help others? Come and join us at security.stackexchange.com.
Filed under Configuration Password Question of the Week