NCSC urges organisations to use BitLocker pre-boot authentication

The UK National Cyber Security Centre (NCSC) is encouraging organisations to configure Microsoft BitLocker with a pre-boot PIN, warning that encryption without an additional authentication step can leave Windows devices more exposed to attacks.

BitLocker encrypts a device’s operating system and stored data, helping protect information if a computer is lost or stolen. However, the NCSC says a PIN provides an important additional safeguard against vulnerabilities in the Windows Recovery Environment (WinRE), a part of Windows designed to repair systems and recover data when problems occur.

Why WinRE matters

WinRE contains files that are not encrypted by BitLocker so that recovery remains possible if encryption itself contributes to a system failure. That design creates an area that attackers may try to exploit. Recent research, including the vulnerability referred to as YellowKey, demonstrated how weaknesses in WinRE could potentially be used to bypass some BitLocker protections. Microsoft has previously disclosed and patched similar issues.

The NCSC describes these incidents as an ongoing consequence of competing design requirements rather than evidence of a hidden backdoor. Because recovery functionality must remain available, new bugs affecting this component may continue to emerge. Requiring a PIN means an attacker must first pass an additional authentication check before using recovery tools, reducing the impact of this class of attack.

Options when a PIN is impractical

The agency recognises that manually entering a PIN may not suit every deployment, including shared hot-desking computers, systems used in emergencies, or machines that must start without human assistance. It recommends considering alternative controls rather than leaving BitLocker unprotected by pre-boot authentication.

• Reuse an existing PIN: Where appropriate, organisations could align the BitLocker PIN with a Windows Hello PIN, avoiding an additional credential for users.
• Use Network Unlock: Devices connected to a trusted corporate network can obtain the unlock key automatically, while those operating away from that network can still require a PIN.
• Deploy a Startup Key: A USB key can provide pre-boot authentication, although it introduces risks if the device is lost or stolen.
• Apply access restrictions: If no pre-boot method is feasible, conditional-access policies can limit the sensitive services and data available to higher-risk devices.

The NCSC’s central recommendation is that organisations should assess the trade-offs and implement a compensating measure, rather than relying on BitLocker without an additional authentication layer.