Secure boot starts from code in read-only memory that cannot be changed after manufacturing. That code checks the signature of the bootloader against a public key stored in the chip; the bootloader checks the application firmware the same way. If any signature fails, the device halts or falls back to a known-good image. The chain anchors in a hardware root of trust.
Without secure boot, anyone with physical access or a write path to flash can install modified firmware that behaves normally while exfiltrating data or joining a botnet. With it, an OTA update mechanism can be trusted, because unsigned images are rejected. The cost is key management discipline: losing the signing key or shipping with debug keys enabled undoes the protection.
Part of the IoT Glossary. Spotted an error or a missing term? Tell us.