Controlling the boot order on a computer is a foundational security measure that prevents unauthorized users from bypassing the operating system by booting from external media such as USB drives or network sources. Disabling unused boot options like PXE and USB boot reduces the attack surface and keeps the system locked to its intended startup path.
Boot Order Security
I remember back in my computer classes in high school, we would mess with the instructor, and I feel a little bit bad about it now, but we would try to change and manipulate the desktop or certain aspects of the computer. We would change that. And so what he would do is he'd start locking down the computer so we wouldn't be able to change certain aspects of the computer. And what we'd do to get around that is we just boot to a floppy. At the time, they were the 3 and 1/2 inch floppies. We'd pop those in there, we'd boot to floppy, and then we could essentially do anything that we wanted to do.
So one thing that we need to do with our computers is to make sure that an adversary or somebody is not allowed to do that. We need to change the boot order and make sure that the boot order is set properly.
Computers will have some sort of boot order. What was common back about 20 years ago is it would first of all try the network. It would try to do what's called a PXE, or pixie, boot. So it would look at the network and say, hey, do I have an operating system that's available to me? And then if it didn't, then it would go to, at the time there were floppy drives or disc drives, and you would stick a disc into there, then it would try that. And if that didn't have it there, then it would go to USB. And if that wasn't there, then it would go to the hard disk drive.
The reason for this is because you might have had an operating system that needed to be repaired. The operating system was usually installed on some sort of solid state drive or disc drive, and so if you needed to repair that, you would stick in your USB, you'd boot to that, and then you would repair the operating system.
Now the problem is that people can get around security measures by doing this. What will happen is they could stick Linux on a USB thumb drive. They stick that into there, boot up to that Linux version, and then they have access to the full machine and are able to access files. This is problematic from a security perspective.
So one of the first things we're going to want to do, once we update and patch and do all of that, is that we're going to want to change the boot order and remove some of these. Like, we probably don't have a PXE boot on our system, so we turn that off. And USB: once we're done installing the operating system, we're going to want to turn off the USB boot and only turn it on when we're needing that functionality. So now it's just going to boot to the solid state drive or disc drive that you have on the system.
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →