• Logo
    Ubuntu security documentation
  • documentation.ubuntu.com
  • More resources
    • Discourse
    • GitHub
Contents Menu Expand Light mode Dark mode Auto light/dark, in light mode Auto light/dark, in dark mode Skip to content
Ubuntu security documentation
Ubuntu security documentation
  • Software integrity
    • Ubuntu image integrity verification
    • Ubuntu archive integrity verification
  • Security updates
    • Expanded Security Maintenance (ESM)
    • Ubuntu OVAL data
    • Ubuntu OSV data
    • Ubuntu VEX data
  • Ubuntu security features
    • Overview of security features
    • Platform protections
      • CPU features
      • Devices
      • UEFI Secure Boot
      • Trusted Platform Module
    • Privilege restriction
      • AppArmor
      • cgroups
      • Snap confinement
    • Cryptography
      • Cloud PRNG seed
      • Disable legacy TLS
      • Affected libraries and configuration changes
      • Legacy TLS re-enablement (not recommended)
      • Common issues and troubleshooting
      • Security implications and best practices
      • Additional resources
      • Password hashing
      • Cryptographic algorithms
        • Encryption libraries in Ubuntu
        • Algorithms per Ubuntu release
    • Process and memory protections
      • Default compiler and linker flags
      • File handling
      • Address Space Layout Randomization (ASLR)
    • Kernel protections
    • Storage and filesystem
      • Encrypted LVM
      • File encryption
      • Full disk encryption (FDE)
    • Network and firewalls
      • No open ports
      • SYN cookies
      • Firewall
        • nftables
  • Compliance automation
    • Ubuntu Security Guide (USG)
      • Install Ubuntu Security Guide
      • CIS Benchmarks compliance
        • CIS Benchmarks and profiles
        • Auditing an Ubuntu system for CIS Benchmarks compliance
        • Apply the CIS Benchmarks rules to the current system
        • Customizing CIS Benchmarks profiles
      • DISA-STIG compliance
        • Auditing an Ubuntu system for DISA-STIG compliance
        • Apply the DISA-STIG rules
        • Customize DISA-STIG profiles
    • FIPS 140 for Ubuntu
      • Overview of FIPS-certified modules
      • Contacts
      • FIPS and Livepatch
      • Install FIPS mode alongside Ubuntu
      • Enable FIPS mode on Ubuntu
      • FIPS mode with full disk encryption
      • How to connect to Wi-Fi in FIPS mode
      • Troubleshoot common issues
  • Common security mistakes
    • Direct downloading of .debs from the archive
    • Downloading .debs from untrusted sources
    • Unnecessarily open ports
Back to top

Platform protectionsΒΆ

  • CPU features
  • Devices
  • UEFI Secure Boot
  • Trusted Platform Module
Next
CPU features
Previous
Overview of security features
© 2026 CC-BY-SA, Canonical Ltd.
Last updated on Jan 22, 2026
Contents
  • Platform protections