Oracle provides Secure Boot as a primary security feature of its Shielded Instances.

In OCI, Secure Boot is a UEFI (Unified Extensible Firmware Interface) feature that ensures only authorized and digitally signed software can run during the boot process. This is your first line of defense against "bootkits" and "rootkits" that attempt to infect a server before the operating system even loads.

1. How It Works

When Secure Boot is enabled, the system’s UEFI firmware checks the cryptographic signature of every piece of boot software, including:

• UEFI Drivers

• Bootloaders (like GRUB or the Windows Boot Manager)

• Operating System Kernels

If a component is unsigned or has a signature that doesn't match a trusted authority (like Oracle or Microsoft), the boot process is immediately halted. This prevents any malicious code that may have been injected into the boot sequence from executing.

2. VM vs. Bare Metal

Secure Boot is available across OCI's entire "rented" compute spectrum:

• Virtual Machines (VMs): You can enable Secure Boot as part of a "Shielded VM" configuration.

• Bare Metal Servers: You can enable Secure Boot in the physical hardware's BIOS/UEFI settings.

3. Part of the "Shielded Instance" Trio

On OCI, Secure Boot is usually paired with two other hardware-based security features to provide a "hardened" boot environment:

1. Secure Boot: Validates signatures to prevent unauthorized code from running.

2. Measured Boot: Takes a "hash" or fingerprint of the boot components and stores them in the TPM.

3. Trusted Platform Module (TPM): The secure hardware chip that stores those measurements and provides a "Root of Trust."

4. Implementation Details

• Availability: Secure Boot is available on most modern Intel, AMD, and Arm-based shapes.

• OS Support: It is supported by default on Oracle Linux, Ubuntu, CentOS, and Windows Server (including Windows Server 2025).

• Cost: Like other Shielded Instance features, Secure Boot is provided at no additional cost.

Summary: Secure vs. Measured Boot