Definition
Secure boot is a security feature that ensures a device boots using only software that is trusted by the Original Equipment Manufacturer OEM. It verifies the digital signature of each piece of software loaded during the boot process, starting with the firmware and ending with the operating system. This process prevents malicious software, such as rootkits, from loading before the operating system has a chance to load its own security measures. By validating the integrity of the boot chain, secure boot significantly reduces the attack surface for malware that aims to compromise the system at its earliest stages. For instance, it prevents an attacker from replacing the operating system loader with a malicious version. This is distinct from full disk encryption, which protects data at rest but does not prevent boot level malware. Secure boot is a key concept covered in cybersecurity certifications like CompTIA Security+ and CISSP.