Description

Ensure compute instances run as Shielded instances with Secure Boot enabled, so that only boot loaders, kernels, and drivers signed by trusted keys can run when the instance starts. Secure Boot is available on selected shapes and images, which show a shield icon in the Console.

Rationale

Rootkits and bootkits load before the operating system and can hide from normal security tools. Secure Boot checks the signature of each boot component and stops unsigned or tampered code from running. This protects the instance from some of the most persistent and hard-to-detect types of malware.

Impact

  • Blocks unsigned or tampered boot components

  • Protects against rootkits and bootkits

  • Secure Boot can only be set when an instance is created, so existing instances must be recreated

Default Value

By default, Secure Boot is not enabled. It can only be turned on when the instance is created, on supported shapes and images.

Pre-Requisites

  • Permission to manage instances in the compartment

  • A shape and image that support Shielded instances

  • A maintenance window and backup, because the instance must be recreated

Test Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Compute, and select Instances. Choose the compartment and select the instance.

  3. In the Instance information section, under Launch options, check the Secure Boot value.

  4. If Secure Boot shows Disabled, follow the implementation steps.

Implementation Steps

  1. Back up the instance's data, for example by creating a boot volume backup or custom image.

  2. Sign in to the OCI Console at https://cloud.oracle.com.

  3. Open the navigation menu, select Compute, select Instances, and select Create instance.

  4. Choose an image and shape that support Shielded instances (shown with a shield icon).

  5. In the Security section, select Edit, turn on Shielded instance, and turn on Secure Boot.

  6. Complete the other settings to match the original instance and select Create.

  7. Move the workload to the new instance, then terminate the old instance.

Backout Plan

  1. Keep the original instance (or its boot volume backup) until the new instance is confirmed working.

  2. If needed, switch the workload back to the original instance or restore it from the backup.

Reference