Defence

Secure Boot

A firmware check that only lets signed, trusted boot loaders start the computer.

Secure Boot verifies the signature of each component in the boot chain before running it, to keep bootkits out. Flaws in signed boot loaders, or leaked signing keys, let attackers get past it, and revoking the vulnerable components is slow because older machines still depend on them.