Summary
Secure boot is a cryptographic mechanism that verifies the integrity of every software component at device startup, ensuring only digitally signed, authorized firmware and code can run. It is a foundational security control for IoT and embedded devices, particularly in industries like healthcare, transportation, and industrial automation where tampered firmware can have life-safety or regulatory consequences. Digi addresses secure boot through TrustFence, ConnectCore system-on-modules, and cloud-based security services that extend trusted device management from initial design through the full product lifecycle.
- Secure boot verifies the cryptographic signature of every software component at startup, preventing unauthorized or tampered firmware from running.
- It establishes a hardware root of trust using keys burned into the device during manufacturing, creating an immutable foundation that software-level attacks cannot compromise.
- Enabling secure boot is increasingly required by regulations such as the EU Cyber Resilience Act and NIST's IoT cybersecurity framework.
- It is especially critical in healthcare, transportation, industrial, and smart city deployments where compromised firmware can endanger lives or disrupt critical infrastructure.
- Secure boot is a starting point, not a complete strategy — it must be paired with encrypted storage, secure OTA updates, and continuous monitoring across a device's full lifecycle.
- Digi supports secure boot through TrustFence, ConnectCore modules with built-in hardware root of trust, and ConnectCore Security Services for ongoing CVE monitoring and SBOM analysis.
What Is Secure Boot and Why Is It Critical for IoT Security?
If you're designing connected devices with up-to-date security best practices in mind, you may be wondering: what is secure boot? In this blog post, we'll discuss what it is, how it works, why it matters, and what it means for your deployment.
So, what is secure boot, and how does it fit into the architecture of an embedded design to protect connected devices from tampering throughout their lifecycle? In essence, secure boot acts as a gatekeeper at every startup, allowing only verified software to run on your device. This critical process ensures that each and every time your product comes online, only authenticated, digitally signed firmware, operating systems, and software are allowed to load, helping to defend systems against low-level threats such as bootkits and pre-OS malware.
IoT security begins before a single application runs. It starts with your initial design. Planning, prototyping and building a connected product today must include designing in secure boot, not only for the security of your solutions in the field, but also as part of a strategy to ensure your products are in compliance with security regulations like the EU Cybersecurity Act (CRA).
Read on to learn more about secure boot, how it compares to related controls and common implementation challenges, and how Digi's solutions support trusted device design from silicon to cloud.
Explore Digi TrustFence, Digi's integrated IoT security framework →
The Growing Security Risk at Device Startup
Device startup is one of the most exploited attack surfaces in IoT device security. Before the OS loads and before any monitoring agent is active, the boot sequence executes in a largely unprotected state, making it a prime target. According to SonicWall's 2025 Cyber Threat Report, IoT attacks rose 124% in 2024. Unpatched firmware accounts for 60% of IoT breaches, according to the IoT Security Foundation. In large-scale or remote deployments, where devices may go untouched for years, a compromised boot sequence can silently undermine device trust, reliability, and operational safety with no visible indication to the teams responsible.
What Is Secure Boot?
Secure boot is a security mechanism that verifies the integrity and authenticity of every software component executed at device startup before it is allowed to run. Rather than assuming the firmware or bootloader is trustworthy, secure boot requires cryptographic proof: each component must carry a valid digital signature from a trusted authority. If that signature cannot be verified, the code does not execute. This makes secure boot the most foundational layer of IoT device security, ensuring only authorized, unmodified software can bring a device online.
Secure Boot vs. Related IoT Security Concepts
What's secure boot compared to related controls? The distinctions matter for building a complete defense.
- Secure boot vs. secure firmware updates: Secure boot verifies code at startup; secure firmware updates verify OTA-delivered code before installation. Both use signature verification but at different lifecycle points. You need both.
- Secure boot vs. encryption at rest: Encryption at rest protects stored data from being read; secure boot prevents unauthorized code from being executed. Distinct threats requiring distinct controls.
- Secure boot vs. device authentication: Device authentication proves a device's identity to a network. Secure boot proves the software running on that device is trusted. Both are required pillars of complete IoT security.
Explore the 10 key security factors device designers should evaluate when building connected devices
What Does Secure Boot Do?
What does secure boot do during device startup? It enforces cryptographic checks across every component that loads, from the lowest-level bootloader through the OS. What does secure boot do when a check fails? It halts execution entirely. Each verification step builds on the last, creating a continuous chain of trust that prevents unauthorized code from running. The sections below walk through each component.
Hardware Root of Trust
Every secure boot implementation begins with a hardware root of trust, meaning cryptographic keys or hashes burned permanently into the device's hardware during manufacturing, typically in one-time-programmable fuses. Because these values reside in hardware rather than software, they cannot be altered by an attacker with flash access. This immutable anchor is what gives secure startup its foundational credibility.
Cryptographic Signature Verification
Secure boot uses public-key cryptography to verify the digital signature of each component before execution. Firmware is signed with a private key held by the manufacturer; the corresponding public key is stored in hardware. If the signature doesn't match, either because code has been modified or replaced, verification fails and execution stops, blocking tampered or malicious firmware.
Chain of Trust from Bootloader to OS
Secure boot establishes a full chain of trust: the hardware root of trust verifies the first-stage bootloader, which verifies the second-stage bootloader, which verifies the kernel, and so on. Each stage authenticates the next. If any link fails validation, the process stops; a compromise cannot propagate forward through the secure startup sequence.
What Happens When Verification Fails
When secure boot detects software artefacts that cannot be verified, the device refuses to complete startup. Depending on configuration, it may enter recovery mode, generate an alert, or halt entirely. This is deliberate: a device that won't boot is far safer than one running compromised firmware, even if it causes a temporary operational interruption.
Read about the latest IoT cybersecurity trends shaping how connected devices are designed and protected
Why Secure Boot Is Essential for IoT and Embedded Systems
Secure boot is especially critical for IoT and embedded systems because these devices operate unattended, at scale, in remote environments where physical security monitoring is impractical. An IoT device in a substation or traffic cabinet may run for years without physical access. Enabling secure boot ensures that even if an attacker gains physical access or injects code through a compromised update channel, the device will refuse to execute unauthorized software. Beyond risk reduction, secure boot supports compliance with emerging regulations including the EU Cyber Resilience Act and NIST's IoT cybersecurity framework.
Common Challenges with Enabling Secure Boot
Enabling secure boot in real-world embedded products is not trivial. Understanding the pitfalls early prevents costly redesigns.
- Hardware constraints: Not all SoCs support the cryptographic hardware required for a hardware root of trust. Evaluating silicon security at the design stage rather than retrofitting later is essential. Platforms like Digi ConnectCore include this support by default.
- Key management: How to set up secure boot correctly requires generating and protecting cryptographic signing keys for the entire product lifecycle. Lost or compromised keys can make future firmware updates impossible.
- Lifecycle complexity: Teams that treat secure boot as an afterthought find that retrofitting it across a deployed fleet is prohibitively complex. Plan it at the architecture stage, not at ship time.
Follow the step-by-step documentation for how to enable secure boot on Digi ConnectCore modules
When Secure Boot Is Most Critical
While secure boot is a best practice for any connected device, certain environments make it essential. In industries where device compromise can endanger lives, disrupt critical infrastructure, or trigger regulatory liability, secure boot is a non-negotiable design requirement.
Public Infrastructure and Smart Cities
Traffic management systems, utility controls, and smart city infrastructure operate continuously and affect public safety directly. A tampered device in a traffic signal network or grid controller can create dangerous physical-world conditions. Secure boot ensures smart city devices run only verified, authorized code, protecting both uptime and public safety.
Explore Digi's smart city solutions
Transportation Systems
Connected transportation, from fleet telematics to rail communications, depends on devices that perform with absolute consistency. Unauthorized software changes in a transportation control system can create safety risks or interrupt service for thousands of passengers. Secure boot is a core IoT device security requirement for any transportation deployment.
Explore Digi's transportation solutions
Industrial Control and Automation
Industrial environments use connected devices to manage physical processes including machinery, motors, valves, and sensors where compromised boot software can trigger dangerous failures or production shutdowns. The consequences of tampered firmware on a PLC or industrial gateway extend beyond financial loss to operational safety.
Explore Digi's industrial solutions
Medical and Regulated Environments
Medical devices face stringent regulatory requirements around software integrity, including FDA cybersecurity guidance. A device that cannot verify its software at startup cannot guarantee patient safety or regulatory compliance. Secure boot supports the validation and auditability requirements of medical IoT device security at every stage.
Explore Digi's medical solutions
Secure Boot as Part of a Complete Device Security Strategy
Secure boot is the starting point, not the finish line. Fully protecting a connected device requires security controls across the entire lifecycle from design through deployment, OTA updates, and end-of-life. Digi offers an integrated portfolio that makes it practical to implement secure boot alongside encrypted storage, authenticated firmware updates, and continuous remote monitoring.
Digi TrustFence
Digi TrustFence is Digi's integrated IoT security framework covering secure boot, encrypted storage, device identity, and access control in one cohesive platform. Built into Digi ConnectCore modules, TrustFence eliminates the need to build security infrastructure from scratch, simplifying how to enable secure boot in production hardware.
Digi ConnectCore
Digi ConnectCore system-on-modules include fully integrated Digi TrustFence, providing hardware root of trust, cryptographic fuses, and secure element support paired with open-source Linux tooling for how to set up secure boot from day one of product development.
Digi ConnectCore Cloud Services
Digi ConnectCore Cloud Services complements secure boot across a device's operational life, enabling secure OTA firmware updates, configuration monitoring, automated compliance checks, and security alerts across thousands of field-deployed devices, maintaining the trust established at secure startup continuously.
Digi ConnectCore Security Services
Digi ConnectCore Security Services extend protection beyond the boot sequence with continuous SBOM analysis, CVE scanning, and curated vulnerability reporting integrated into the Digi Embedded Yocto build environment, giving teams ongoing visibility into what's running and whether it remains secure after deployment.
How Digi Supports Secure Boot and Trusted Device Foundations
Secure boot is not a checkbox. It's a commitment to devices that can be trusted from their very first instruction. Digi brings together the hardware, software, and cloud tools needed to implement secure boot and sustain that trust at scale in the most demanding environments. Whether designing a new product or securing an existing fleet, Digi's integrated approach, which includes software and solutions including TrustFence, ConnectCore, and Digi ConnectCore Security Services, helps to reduce the complexity that makes IoT security challenging for OEMs.
Explore Digi TrustFence
Secure Boot FAQs
What does secure boot do for IoT devices?
Secure boot verifies the cryptographic signature of every component, including bootloader, kernel, and software, before allowing execution at startup. If any component has been tampered with, secure boot prevents the device from completing startup, preserving software integrity by stopping attackers from running unauthorized code even if they have gained physical access.
Should secure boot be enabled on IoT and embedded devices?
Yes. Enabling secure boot is a foundational best practice for any IoT device in a connected, mission-critical, or regulated environment. Regulations such as the EU Cyber Resilience Act and NIST's IoT cybersecurity guidance increasingly treat it as a baseline requirement. For healthcare, industrial, and transportation deployments, enabling secure boot is an expectation, not an option.
Step-by-step documentation is available at docs.digi.com
How can you check if secure boot is enabled?
To check if secure boot is enabled on a Digi ConnectCore device, run the TrustFence status command from the U-Boot console. It reports whether OTP key fuses are programmed and locked, and whether the device is in an open or closed (enforced) state. On other platforms, the method to check if secure boot is enabled varies. Consult your SoC vendor's documentation.
How is secure boot different from secure startup?
What is secure boot in comparison with secure startup? Secure startup broadly covers all protections during device initialization such as power-on self-tests, hardware checks, configuration validation. Secure boot is the cryptographic subset: verifying digital signatures on software before execution. It is the most critical component of any secure startup strategy, but a complete approach also incorporates hardware root of trust and tamper detection.