¿Qué errores comunes debe evitar al configurar el orden de arranque en el BIOS?

While using the USB as a boot device for initial setups can be useful, this is a one-time event and no modern system should really need to use that feature after that step. However organization that leave this turned on open themselves up to potential cybersecurity risks, as a threat actor with physical access could use this attack vector to bypass other security measures and get data from the system or the user. You should make sure that as part of the initial setup, once you no longer need to boot from another device, that you disable this. If you need to rebuild the system later on you can always enable it again at that time.

Many organizations forget about the network boot option, either because they forget it is there, or because they assume since they don’t have it configured on their network, they don’t have to worry about it. However, it is easy for somebody with physical access to create a mini private network and move the target system to that during the boot process. Even without physical access an attacker could use malware to create a backdoor boot server on your full network, and potentially take over multiple systems. If you do not need the network boot feature, or any feature for that matter, disable it rather than just assume you don’t use it so it does not matter.

When changing BIOS or UEFI settings on an enterprise owned device, ensure you lock it with a unique password known only to the IT admin team. You can set up the most secure boot process in the world, but if all I have to do is hit [insert F key here] to make my external boot device the primary, then it’s all for naught.

In a world of cybersecurity concerns, abusing the boot order can be a path to compromise the systems. Even if you create the best boot sequence, and lock down other features, if you allow anybody change it afterwards then your no longer secure. Implementing a password for your BIOS is an important step. At a minimum you should have an organization wide password, though these often leak out, and become common knowledge with non-IT staff. A better solution is a departmental password, so any potential leaks will have less reach and impact. But the gold standard would be to use your assed management system to track individual passwords for each system.