hardware assurance best practices

due diligence

a legal principle that a subject has used best practice or reasonable care when setting up, configuring, and maintaining a system

trusted foundry

a microprocessor manufacturing utility that is part of a validated supply chain where hardware and software does not deviate from its documented function

• trusted foundry program is operated by the Department of Defense(DoD). the DoD has set up a Trusted Foundry Program, operated by the Defensive Microelectronics Activity(DMEA). accredsited suppliers have proved themselves capable of operating a secure supply chain, from design through to manufacture and testing. the trusted foundry program to help assure the integrity and confidentiality of circuits and manufacturing. the purpose is to help verify that agents of foreign governments are not able to insert malicious code or chips into the hardware being used by the military systems

hardware source authenticity

the process of ensuring that hardware is procured tamper-free from trustworthy suppliers

hardware root of trust(ROT)

a cryptographic module embedded within a computer system that can endorse trusted execution and attest to boot settings and metrics

trusted platform module(TPM)

a specification for hardware-based storage of digital certicates, keys, hashed passwords, and other user and platform identification information

• is part of the system that allows for the ability to ensure secure boot up

• also used with full disk encryption

• - can be managed in windows via the tpm.msc console or through group policy

hardware security module(HSM)

an appliance for generating and storing cryptographic keys that is less susceptible to tampering and insider threats than software-based storage

anti-tamper

methods that make it difficult for an attacker to alter the authorized execution of software

• anti-tamper mechanisms include a field programmable gate array(FPGA) and a physically unclonable function(PUF)

firmware exploit

gives an attacker an opportunity to run any code at the highest level of CPU privilege

unified extensible firmware interface(UEFI)

a type of system firmware providing support 64-bit CPU operation at boot, full GUI and mouse operation at boot, and better boot security(UEFI)

secure boot

a UEFI feature that prevents unwanted processes from executing during the boot operation

measured boot

a UEFI feature that gathers secure metrics to validate the process in an attestation report

attestation

a claim that the data presented in the report is valid by digitally signing it using the TPM’s private key

eFUSE

a means for software or firmware to permanently alter the state of a transistor on a computer chip

trusted firmware update

a firmware update that is digitally signed by the vendor and trust by the system before installation

self-encrypting drive

a disk drive where the controller can automatically encrypt data that is written to it

secure processing

a mechanism for ensuring the confidentiality, integrity, and availability of software code and data as it is executed in volatile memory

processor security extensions

low-level CPU changes and instructions that enable secure processing

• depends on if you’re using an AMD ot INTEL

• AMD: secure memory encryption(SME), Secure Encrypted Virtualization(SEV)

• Intel: Trusted Execution Technology(TXT), Software Guard Extensions(SGX)

trusted execution

the CPU’s security extensions invoke a TPM and secure boot attestastion to ensure that a trusted operating system is running

secure enclave

an extension that allows a trusted process to create an encrypted container for sensitive data

atomic execution

certain operations that should only be performed once or not at all, such as initializing a memory location

bus encryption

data that is encrypted by an application prior to being placed on the data bus

• ensure the device at the end of the bus is trusted to decrypt the data

you suspect that a system’s firmware has been compromised. which type of firmware would provide resistance against such an attack?

trusted firmware. trusted firmware is designed to be resistant to attacks, providing a secure foundation for system boot and operating system load