Difference between revisions of "Trusted Computing"

From MgmtWiki
Jump to: navigation, search
(→‎Trusted Supply Chain)
(→‎Trusted Supply Chain)
Line 12: Line 12:
 
Before the Huawei troubles<ref>Emily Stewart, ''The US government’s battle with Chinese telecom giant Huawei, explained'' Recode (2019-05-21) https://www.vox.com/technology/2018/12/11/18134440/huawei-executive-order-entity-list-china-trump</ref> the most common response to a question about supply chain corruption was met with comments like "you must be in real trouble if you don't know where your computers are coming from." It is still likely that most threat analysis will omit any concern with supply chain corruption. Even though it may be incredibly difficult to get management to consider supply chain issues, it is not useful to address any security issues if you cannot even be sure that the computers delivered are free of deliberate or accidental vulnerabilities.
 
Before the Huawei troubles<ref>Emily Stewart, ''The US government’s battle with Chinese telecom giant Huawei, explained'' Recode (2019-05-21) https://www.vox.com/technology/2018/12/11/18134440/huawei-executive-order-entity-list-china-trump</ref> the most common response to a question about supply chain corruption was met with comments like "you must be in real trouble if you don't know where your computers are coming from." It is still likely that most threat analysis will omit any concern with supply chain corruption. Even though it may be incredibly difficult to get management to consider supply chain issues, it is not useful to address any security issues if you cannot even be sure that the computers delivered are free of deliberate or accidental vulnerabilities.
  
−
On 2018-10-08 Business week reported<ref>Jordan Robertson + 1, ''The Big Hack'' Business week p. 52ff</ref>
+
On 2018-10-08 Business week reported<ref>Jordan Robertson + 1, ''The Big Hack'' Business week p. 52ff</ref> that a major supplier in computer hardware manufactured in China had been hacked at the site of a contractor. This hardware wound up in machines at the DoD and many other sites. Naturally many of the targets of the attack have denied any impact to their business, as would be expected ( see wiki page [[Conduct Risk]]).
  
 
===Trusted Platform Module===
 
===Trusted Platform Module===

Revision as of 13:52, 6 September 2019

Full Title

Trusted Computing is a set of solutions to assure that computing devices are who they say they are and are able to keep user secrets protected from programs running on the devices.

Context

There has been a recognized effort to create a separate execution environment that would be unaffected by malware running in the main computer. The first effort was started in 1995-02-21 in the Intel Data Security Operation where a 386 based co-processor was developed that could use the main data store by encryption and decryption of all data on the fly. This was widely realized with the TPM 1.0 hardware chips in the late 1990 and now with separate instruction sets on ARM and Intel processors.

Problems

  • Trusted computing is, by design, built to solve enterprise data security issues. The result is devices that can be wiped clean by the enterprise IT department. Not the sort of solution that would be acceptable to most users.
  • Trusted Computing is just a hardware assist for security. It requires an easy to use API to make that accessible to programmers, and, through them, to users. See the page on the wiki Trusted Execution Environment for the APIs.

Solutions

Trusted Supply Chain

Before the Huawei troubles[1] the most common response to a question about supply chain corruption was met with comments like "you must be in real trouble if you don't know where your computers are coming from." It is still likely that most threat analysis will omit any concern with supply chain corruption. Even though it may be incredibly difficult to get management to consider supply chain issues, it is not useful to address any security issues if you cannot even be sure that the computers delivered are free of deliberate or accidental vulnerabilities.

On 2018-10-08 Business week reported[2] that a major supplier in computer hardware manufactured in China had been hacked at the site of a contractor. This hardware wound up in machines at the DoD and many other sites. Naturally many of the targets of the attack have denied any impact to their business, as would be expected ( see wiki page Conduct Risk).

Trusted Platform Module

Other Trusted Platforms

Trusted Mobility Solutions

Trust on Windows Platforms

  • Trustworthy computing become a common goal for computers commercially available to users with the Windows XPSP2 update that began in 2002.
  • Secure Workstation creates roots of trust.

Trust on Android Platforms

  • Google Project Zero
  • Hardware designed to defend "At the deepest level, we leverage the hardware itself to protect access to the device. This includes a secure lock screen, Verified Boot to make sure the device hasn’t been tampered with, plus hardware-assisted encryption and key handling to help keep data safe, both in transit and at rest. Our newest OS, Android 9 Pie, also supports certified, tamper-resistant hardware."
  • Trusty is a secure Operating System (OS) that provides a Trusted Execution Environment (TEE) for Android. The Trusty OS runs on the same processor as the Android OS, but Trusty is isolated from the rest of the system by both hardware and software.

Trust on Apple iPhone Platforms

References

  1. ↑ Emily Stewart, The US government’s battle with Chinese telecom giant Huawei, explained Recode (2019-05-21) https://www.vox.com/technology/2018/12/11/18134440/huawei-executive-order-entity-list-china-trump
  2. ↑ Jordan Robertson + 1, The Big Hack Business week p. 52ff
Retrieved from "http://tcwiki.azurewebsites.net/index.php?title=Trusted_Computing&oldid=6517"