Trusted Computing - Revision history

Tom: /* References */

2021-02-17T19:51:03Z

‎References

Tom: /* Trusted Supply Chain */

2021-02-17T19:50:22Z

‎Trusted Supply Chain

Tom: /* Trusted Supply Chain */

2019-09-06T21:01:28Z

‎Trusted Supply Chain

Tom: /* Trusted Supply Chain */

2019-09-06T20:54:00Z

‎Trusted Supply Chain

Tom: /* Trusted Supply Chain */

2019-09-06T20:52:44Z

‎Trusted Supply Chain

Tom: /* Trusted Supply Chain */

2019-09-06T20:46:28Z

‎Trusted Supply Chain

Tom: /* Trust on Windows Platforms */

2019-07-25T03:29:58Z

‎Trust on Windows Platforms

Tom: /* Trusted Mobility Solutions */

2019-07-22T19:38:43Z

‎Trusted Mobility Solutions

Tom: /* Trust on Windows Platforms */

2019-07-22T19:38:08Z

‎Trust on Windows Platforms

Tom: /* Solutions */

2019-07-22T19:32:01Z

‎Solutions

← Older revision		Revision as of 19:51, 17 February 2021
Line 38:		Line 38:

	[[Category:Glossary]]		[[Category:Glossary]]
		+	[[Category:Security]]
	[[Category:Trust]]		[[Category:Trust]]

@@ Line 10: / Line 10: @@
 ==Solutions==
 ===Trusted Supply Chain===
-Before the Huawei troubles<ref>Emily Stewart, ''The US government’s battle with Chinese telecom giant Huawei, explained'' Recode (2019-05-21) https://www.vox.com/technology/2018/12/11/18134440/huawei-executive-order-entity-list-china-trump</ref> the most common response to a question about supply chain corruption was met with comments like "you must be in real trouble if you don't know where your computers are coming from." It is still likely that most threat analysis will omit any concern with supply chain corruption. Even though it may be incredibly difficult to get management to consider supply chain issues, it is not useful to address any security issues if you cannot even be sure that the computers delivered are free of deliberate or accidental vulnerabilities.
+Before the Huawei troubles<ref>Emily Stewart, ''The US government’s battle with Chinese telecom giant Huawei, explained'' Recode (2019-05-21) https://www.vox.com/technology/2018/12/11/18134440/huawei-executive-order-entity-list-china-trump</ref> the most common response to a question about [[Supply Chain]] corruption was met with comments like "you must be in real trouble if you don't know where your computers are coming from." It is still likely that most threat analysis will omit any concern with supply chain corruption. Even though it may be incredibly difficult to get management to consider supply chain issues, it is not useful to address any security issues if you cannot even be sure that the computers delivered are free of deliberate or accidental vulnerabilities.
 On 2018-10-08 Business week reported<ref>Jordan Robertson + 1, ''The Big Hack'' Business week 2018-10-08 p. 52ff</ref> that a major supplier of computer hardware manufactured in China had been hacked at the site of a subcontractor. This hardware wound up in machines at the DoD and many other sites. Naturally many of the targets of the attack have denied any impact to their business, as would be expected (see wiki page [[Conduct Risk]]). In this case it has been alleged that the Chinese military infiltrated the manufacturing process with the expectation that the devices would be installed in sensitive sites and then "phone home" for attack software.

@@ Line 12: / Line 12: @@
 Before the Huawei troubles<ref>Emily Stewart, ''The US government’s battle with Chinese telecom giant Huawei, explained'' Recode (2019-05-21) https://www.vox.com/technology/2018/12/11/18134440/huawei-executive-order-entity-list-china-trump</ref> the most common response to a question about supply chain corruption was met with comments like "you must be in real trouble if you don't know where your computers are coming from." It is still likely that most threat analysis will omit any concern with supply chain corruption. Even though it may be incredibly difficult to get management to consider supply chain issues, it is not useful to address any security issues if you cannot even be sure that the computers delivered are free of deliberate or accidental vulnerabilities.
-On 2018-10-08 Business week reported<ref>Jordan Robertson + 1, ''The Big Hack'' Business week p. 52ff</ref> that a major supplier of computer hardware manufactured in China had been hacked at the site of a subcontractor. This hardware wound up in machines at the DoD and many other sites. Naturally many of the targets of the attack have denied any impact to their business, as would be expected ( see wiki page [[Conduct Risk]]).
+On 2018-10-08 Business week reported<ref>Jordan Robertson + 1, ''The Big Hack'' Business week 2018-10-08 p. 52ff</ref> that a major supplier of computer hardware manufactured in China had been hacked at the site of a subcontractor. This hardware wound up in machines at the DoD and many other sites. Naturally many of the targets of the attack have denied any impact to their business, as would be expected (see wiki page [[Conduct Risk]]). In this case it has been alleged that the Chinese military infiltrated the manufacturing process with the expectation that the devices would be installed in sensitive sites and then "phone home" for attack software.
 ===Trusted Platform Module===

@@ Line 12: / Line 12: @@
 Before the Huawei troubles<ref>Emily Stewart, ''The US government’s battle with Chinese telecom giant Huawei, explained'' Recode (2019-05-21) https://www.vox.com/technology/2018/12/11/18134440/huawei-executive-order-entity-list-china-trump</ref> the most common response to a question about supply chain corruption was met with comments like "you must be in real trouble if you don't know where your computers are coming from." It is still likely that most threat analysis will omit any concern with supply chain corruption. Even though it may be incredibly difficult to get management to consider supply chain issues, it is not useful to address any security issues if you cannot even be sure that the computers delivered are free of deliberate or accidental vulnerabilities.
-On 2018-10-08 Business week reported<ref>Jordan Robertson + 1, ''The Big Hack'' Business week p. 52ff</ref> that a major supplier in computer hardware manufactured in China had been hacked at the site of a contractor. This hardware wound up in machines at the DoD and many other sites. Naturally many of the targets of the attack have denied any impact to their business, as would be expected ( see wiki page [[Conduct Risk]]).
+On 2018-10-08 Business week reported<ref>Jordan Robertson + 1, ''The Big Hack'' Business week p. 52ff</ref> that a major supplier of computer hardware manufactured in China had been hacked at the site of a subcontractor. This hardware wound up in machines at the DoD and many other sites. Naturally many of the targets of the attack have denied any impact to their business, as would be expected ( see wiki page [[Conduct Risk]]).
 ===Trusted Platform Module===

@@ Line 12: / Line 12: @@
 Before the Huawei troubles<ref>Emily Stewart, ''The US government’s battle with Chinese telecom giant Huawei, explained'' Recode (2019-05-21) https://www.vox.com/technology/2018/12/11/18134440/huawei-executive-order-entity-list-china-trump</ref> the most common response to a question about supply chain corruption was met with comments like "you must be in real trouble if you don't know where your computers are coming from." It is still likely that most threat analysis will omit any concern with supply chain corruption. Even though it may be incredibly difficult to get management to consider supply chain issues, it is not useful to address any security issues if you cannot even be sure that the computers delivered are free of deliberate or accidental vulnerabilities.
-On 2018-10-08 Business week reported<ref>Jordan Robertson + 1, ''The Big Hack'' Business week p. 52ff</ref>
+On 2018-10-08 Business week reported<ref>Jordan Robertson + 1, ''The Big Hack'' Business week p. 52ff</ref> that a major supplier in computer hardware manufactured in China had been hacked at the site of a contractor. This hardware wound up in machines at the DoD and many other sites. Naturally many of the targets of the attack have denied any impact to their business, as would be expected ( see wiki page [[Conduct Risk]]).
 ===Trusted Platform Module===

@@ Line 24: / Line 24: @@
 ===Trust on Windows Platforms===
 * Trustworthy computing become a common goal for computers commercially available to users with the Windows XPSP2 update that began in 2002.
 ===Trust on Android Platforms===

@@ Line 20: / Line 20: @@
 ===Trusted Mobility Solutions===
 * [https://trustedcomputinggroup.org/wp-content/uploads/TCG_TMS_Use_Cases_Mobile_v2r47.pdf TCG Trusted Mobility Solutions Work Group Use Cases – Enterprise, Financial, & NFV] was published 2018-09-26.
-* Mobile Trusted Module (MTM) – [http://rtcgroup.com/arm/2007/presentations/193%20-%20Understanding%20Trusted%20Computing%20Group%20Standards%20for%20Mobile%20Phones%20and%20Trusted%20Storage%20Drives.pdf Understanding Trusted Computing Group Standards for Mobile Phones and Trusted Storage Drives] printed in 2007, but never took off, still the thought was good
+* Mobile Trusted Module (MTM) – [http://rtcgroup.com/arm/2007/presentations/193%20-%20Understanding%20Trusted%20Computing%20Group%20Standards%20for%20Mobile%20Phones%20and%20Trusted%20Storage%20Drives.pdf Understanding Trusted Computing Group Standards for Mobile Phones and Trusted Storage Drives] printed in 2007, but never took off, still the thought was good.
 ===Trust on Windows Platforms===

← Older revision		Revision as of 19:38, 22 July 2019
Line 24:		Line 24:

	===Trust on Windows Platforms===		===Trust on Windows Platforms===
		+	* Trustworthy computing become a common goal for computers commercially available to users with the Windows XPSP2 update that began in 2002.

	===Trust on Android Platforms===		===Trust on Android Platforms===

@@ Line 14: / Line 14: @@
 ===Trusted Platform Module===
 *[https://trustedcomputinggroup.org/ Trusted Computing Group] announced that its [https://trustedcomputinggroup.org/resource/tss-overview-common-structures-specification/ TPM 2.0 (Trusted Platform Module)] Library Specification was approved as a formal international standard under ISO/IEC ISO/IEC 11889:2015 (the International Organization for Standardization and the International Electrotechnical Commission). TCG has 90+ specifications and guidance documents to help build a trusted computing environment. A good suppary can be found in the [https://trustedcomputinggroup.org/resource/tss-overview-common-structures-specification/ TCG TSS 2.0 Overview and Common Structures Specification].
 ===Trusted Mobility Solutions===
 * [https://trustedcomputinggroup.org/wp-content/uploads/TCG_TMS_Use_Cases_Mobile_v2r47.pdf TCG Trusted Mobility Solutions Work Group Use Cases – Enterprise, Financial, & NFV] was published 2018-09-26.
 * Mobile Trusted Module (MTM) – [http://rtcgroup.com/arm/2007/presentations/193%20-%20Understanding%20Trusted%20Computing%20Group%20Standards%20for%20Mobile%20Phones%20and%20Trusted%20Storage%20Drives.pdf Understanding Trusted Computing Group Standards for Mobile Phones and Trusted Storage Drives] printed in 2007, but never took off, still the thought was good
 * [https://source.android.com/security/trusty Trusty is a secure Operating System (OS)] that provides a Trusted Execution Environment (TEE) for Android. The Trusty OS runs on the same processor as the Android OS, but Trusty is isolated from the rest of the system by both hardware and software.
-===Global Platform===
-* [https://globalplatform.org/latest-news-overview/ Global Platform Latest News]
+===Trust on Apple iPhone Platforms===
 ==References==