How to prevent booting from live media?

Question

Information Security

Actually a hole in the security of most organizations: booting from live media. In practice, it turned out to be insufficient to set a password on the BIOS, since some of them automatically set the connected devices first at boot.
Is there any unified way to protect, other than picking every BIOS?

Answer 1

Unfortunately, you can't do without picking the BIOS on a PC.
In the selection of boot devices, specify the specific device from which you want to boot.
In advanced settings, disable the ability to boot from USB/PCI/LAN devices.
Password on the BIOS, sealing the system unit, as a "guarantee" against opening and resetting by closing contacts.

Answer 2

Physically closing USB ports and disabling CD-ROMs.

Answer 3

To be stunned, colleagues - yes, the method of minimizing this risk is the ENCRYPTION of the disk stupidly. By the way, it also covers the risk of "they will take away the disk", since your attacker already has physical access to the PC

Answer 4

It all depends on your needs/budget.
For example, there is this (and with certificates from whom you need and with the corresponding price, including): Trusted Boot Hardware Module (AMDZ)