secure boot
termsecurity
Checking each stage of startup against a signature before running it, so code that loads before the operating system cannot be replaced silently.
It closes a specific gap: anything running before the operating system is above every defence the operating system provides, so a bootkit sees the security software start and can lie to it. The chain has to be rooted in hardware. The trade is control - the same mechanism that stops unsigned malicious code stops unsigned legitimate code, which is why the argument about who holds the signing keys for general-purpose hardware is a genuine one rather than an obstruction.
Also known as: measured boot