Secure Boot
A chain-of-trust mechanism that ensures only cryptographically signed firmware and software can run on a device.
Definition
Secure Boot is a chain-of-trust mechanism - typically rooted in a hardware security element (TPM, PUF, or vendor-specific root key) - that cryptographically verifies each stage of the boot process before executing it. The boot ROM verifies the bootloader, the bootloader verifies the kernel/firmware image, and the firmware verifies application binaries. Any signature failure halts boot or triggers recovery, preventing persistence of malware that survives reboot.What this means in practice
Secure Boot dramatically raises the cost of persistent compromise. Without it, an attacker who modifies firmware (via supply-chain, physical access, or remote exploit) gains a foothold that survives every reboot, OS reinstall, and OTA update. Medical devices that handle patient data or actuate therapy generally need secure boot as a baseline.- •Storing the root key in firmware-readable memory rather than a hardware secure element.
- •Disabling secure boot in 'developer mode' on production devices.
- •Failing to plan key rotation - a compromised root key affects every device built with it.
Frequently asked questions
Related terms
Grouped by themeEditor's picks
· Hand-selected related conceptsRemote, network-delivered software or firmware updates to a fielded medical device.
The designed-in ability to deploy security updates to a fielded medical device in a timely, controlled, and verifiable manner.
The bundle of cybersecurity artifacts a sponsor includes in a 510(k), De Novo, PMA, or HDE submission for a cyber device.
The federal statute that gives FDA explicit premarket authority over cybersecurity for cyber devices.
More in Cybersecurity
· Same categoryAAMI/ANSI standard establishing requirements for medical-device cybersecurity activities throughout the lifecycle.
AAMI Technical Information Report providing MedTech-specific guidance on cybersecurity risk management.
AAMI Technical Information Report on post-market security risk management for medical device manufacturers, the operational companion to TIR57.
Unauthorized remote control of an implanted neurostimulator (e.g., DBS) to alter stimulation parameters and harm a patient.
Primary references
3 sources- 1
NIST SP 800-193 Platform Firmware Resiliency GuidelinesVerifiedNISTcsrc.nist.gov
- 2
FDA Cybersecurity Guidance (Sept 2023)VerifiedFDAfda.gov
- 3
FDA - Cybersecurity for Medical DevicesVerifiedFDAfda.gov
Inline markers like [1] jump to the matching reference above.