Ubuntu: Engineered for security.
Built for usability
Ubuntu's platform security features are carefully designed to enhance security while providing an intuitive user experience – from hardware roots of trust to secure boot and confidential computing.
Secure boot
Secure boot is a security feature that enforces a chain of trust during the boot process, preventing unauthorized code from running and ensuring that only signed, trusted software is loaded. On Ubuntu, all pre-built boot binaries, except the initrd, are signed with Canonical’s UEFI certificate.
Securing early boot software and firmware is critically important as it acts as a root of trust for the entire platform. When compromised, they allow malware to execute with the highest privileges, even before the OS security mechanisms are loaded.
Full-disk encryption
Full Disk Encryption with passphrases
Ubuntu has designed Full Disk Encryption (FDE) to allow users to encrypt their data while stored on the device’s hard drive or storage disk.
Today, this is achieved using the Linux Unified Key Setup (LUKS) framework, which provides disk encryption at the block level. The data is then only decrypted if the correct passphrase is provided by the user.
TPM backed Full Disk Encryption
Tomorrow’s next generation FDE is already underway and will be backed by a Trusted Platform Module. This eliminates the need to manually enter passphrases and lowers barriers to encryption on shared devices in enterprise environments, simplifying the boot process for large-scale deployments.
Constrain the impact of zero day vulnerabilities with AppArmor
AppArmor enforces Mandatory Access Control through profiles that define strict limits on what applications can access and do. This significantly restrains the attacker’s ability to move laterally within the system.
Ubuntu comes pre-installed with a range of AppArmor profiles for common applications. But if your critical workload application doesn’t have a profile, it is straightforward to create one.