Secure Boot
A chain-of-trust mechanism that ensures only cryptographically signed firmware and software can run on a device.
Definition
Secure Boot is a chain-of-trust mechanism - typically rooted in a hardware security element (TPM, PUF, or vendor-specific root key) - that cryptographically verifies each stage of the boot process before executing it. The boot ROM verifies the bootloader, the bootloader verifies the kernel/firmware image, and the firmware verifies application binaries. Any signature failure halts boot or triggers recovery, preventing persistence of malware that survives reboot.What this means in practice
Secure Boot dramatically raises the cost of persistent compromise. Without it, an attacker who modifies firmware (via supply-chain, physical access, or remote exploit) gains a foothold that survives every reboot, OS reinstall, and OTA update. Medical devices that handle patient data or actuate therapy generally need secure boot as a baseline.Examples
- Before a connected infusion pump starts, its secure boot process verifies that the firmware loaded onto the device is authentic and unaltered, preventing a malicious version from controlling drug delivery.
- When a surgical robot powers on, secure boot checks the cryptographic signatures of its operating system and control software. If any component fails verification, the robot refuses to operate, signaling a potential compromise.
- An implantable cardiac device utilizes secure boot to ensure that only manufacturer-approved and signed software updates can be installed, protecting against unauthorized modifications that could affect patient safety.
- •Storing the root key in firmware-readable memory rather than a hardware secure element.
- •Disabling secure boot in 'developer mode' on production devices.
- •Failing to plan key rotation - a compromised root key affects every device built with it.
Frequently asked questions
Related terms
Grouped by themeEditor's picks
· Hand-selected related conceptsRemote, network-delivered software or firmware updates to a fielded medical device.
The designed-in ability to deploy security updates to a fielded medical device in a timely, controlled, and verifiable manner.
The bundle of cybersecurity artifacts a sponsor includes in a 510(k), De Novo, PMA, or HDE submission for a cyber device.
The federal statute that gives FDA explicit premarket authority over cybersecurity for cyber devices.
More in Cybersecurity
· Same categoryAAMI/ANSI standard establishing requirements for medical-device cybersecurity activities throughout the lifecycle.
AAMI Technical Information Report providing MedTech-specific guidance on cybersecurity risk management.
AAMI Technical Information Report on post-market security risk management for medical device manufacturers, the operational companion to TIR57.
Unauthorized remote control of an implanted neurostimulator (e.g., DBS) to alter stimulation parameters and harm a patient.
Where this term appears across MedTech Terms.
Latest in MedTech
Sources
3 sourcesSources support the definition or relevant regulatory context, not necessarily every claim on this page. Each is graded against our source-tier hierarchy so you can see what rests on binding law versus commentary.
- 1NIST SP 800-193 Platform Firmware Resiliency GuidelinesTier 2 VerifiedNISTcsrc.nist.gov
- 2FDA Cybersecurity Guidance (Sept 2023)Tier 2 VerifiedFDAfda.gov
- 3FDA - Cybersecurity for Medical DevicesTier 2 VerifiedFDAfda.gov
Inline markers like [1] jump to the matching reference above.