Strengthening the pillars of information assurance in a world of evolving threats

It is the responsibility of every organization with an online presence to make sure they protect their data from unwanted access. By now, everyone should be aware of the tremendous damage an organization can face if it falls victim to a successful cyberattack. In a 2022 research report, IBM shared statistics that confirm just how serious the data breach situation is. According to the report:

Globally, the average cost of a data breach is $4.35 million
83 percent of organizations studied reported experiencing at least one data breach
60 percent of the organizations in the report say they were forced to raise the price of their product and/or services due to a data breach

Cybersecurity is a never-ending arms race. As soon as network defenders mediate a threat, attackers begin hunting for a bypass for the fix or a new security vulnerability to exploit. To keep pace with constantly evolving cyberthreats, IT organizations need to adopt fundamental best practices to ensure their networks and data remain secure and available only to authorized users. But as organizations bring more and more servers online to store and share data, even knowing where to start when evaluating a networks’ security posture can be a daunting task.

Thankfully, there are resources that provide a holistic approach to cybersecurity; a way organizations can look at their network’s security in its entirety in order to better maintain it.

Worth examining are the National Institute of Standards and Technology (NIST) cybersecurity publications that touch on the concept of information assurance (IA). As defined by NIST, information assurance is “the degree of confidence one has that security measures protect and defend information and systems by ensuring their availability, integrity, authentication, confidentiality, and non-repudiation. These measures include providing for restoration of information systems by incorporating protection, detection, and reaction capabilities.”

Those five qualities are considered the “pillars” of IA:

Availability: the ability to provide network users with timely and reliable access to a network and its data.
Integrity: the ability to confirm a network and the data on that network have not been tampered with.
Authentication: the ability to confirm that a data source or a network user is legitimate.
Confidentiality: the ability to create and preserve authorized restrictions on network and data access, including means for protecting personal privacy and proprietary information.
Non-repudiation: the ability to confirm the integrity and origin of data in a manner that can be validated by a third party as originating from a specific entity in possession of a private key.

Properly maintaining the five pillars of information assurance is a constant battle, and one that requires many tools.

Antivirus software, corporate firewalls, multi-factor authentication, and other IT security measures are widely used tools that play important roles in many successful cybersecurity strategies, but each has limitations and cannot adequately secure a network on their own.

For example, an emerging threat vector more and more cybercriminals are exploiting is server firmware. Compromising the firmware of a server component exposes a network to a variety of attacks (DDoS, ransomware, IP theft).

Hacked firmware can be particularly hard to find and fix. The reason for this is that most components on a server’s mainboard (the baseboard management controller or BMC, for example) are powered up and become active during the boot process before any of the traditional security measures (antivirus software, firewall, etc.) begin to run.

Even if compromised firmware is discovered, it can be nearly impossible to keep it from re-installing itself every time the server reboots. Even worse? In our global economy, server components move from semiconductor manufacturers to contract OEMs and then on to system integrators before finally being installed in a customer’s data center. At any point in this global supply chain, component firmware can be compromised before it’s brought online in a data center.

In December 2022, researchers at Eclypsium discovered several vulnerabilities in BMC firmware made by AMI. The compromised BMC was widely used in servers built and/or operated by some of the biggest names in tech. BMC attack vectors are remote attacks where the signed and “trusted” software included poor design practices that allowed unauthorized access. It’s important to note that no amount of authentication and verification will prevent poor software security design from becoming an attack surface.

Based on this, if an organization wants to ensure all five pillars of information assurance remain firm, they need to augment their security measures to ensure servers remain secure before measures like antivirus software are active.

A more secure BMC boot process is possible with the use of a Trusted Platform Module (TPM), but this process also needs a Hardware Root of Trust. TPM uses authentication keys protected with powerful cryptography to establish a root of trust during the boot process that confirms all firmware instances on the motherboard are valid and authorized to execute. TPM provides a bank of Platform Configuration Registers (PCRs)—a set of hashes that can be added to, but not overwritten.

A TPM with the addition of a microcontroller and trust anchor companion device for Hardware Root of Trust. Source: Microchip

The addition of a microcontroller (MCU) between the application’s main processor and the Flash memory manages the security of the stored code. The immutable Boot ROM, embedded in the design, is used to store the power on/boot sequence and APIs available during run time.

A trust anchor companion device to the MCU further helps secure the boost process with hardware-based cryptographic key storage and cryptographic countermeasures to eliminate potential backdoors linked to software weaknesses. This provides support for code authentication, message authentication, support for trusted firmware updates, and multiple key management protocols including TLS and other root-of-trust (RoT) based operations.

Now that a RoT is established, the TPM can be trusted to measure the variable aspects of other mainboard components to confirm that they are operating normally before bringing them online. Immediately after powering up, the TPM loader measures itself and puts its hash into the first PCR register, providing the first cryptographic marker of the boot process. Next, before the second mainboard component comes online, its firmware image is validated, and a measurement is made and added to a second PCR register. Then, before the second component starts, both the first and second stage PCR registers are sent to the TPM module. There, the TPM will check the signature on the active/backup kernel images, and if valid, will:

Measure the kernel parameters that will be passed to the kernel image
Measure the environment variables that are stored in Flash
Measure the kernel image to be booted
Execute the kernel image

As the boot process continues and new components need to power up, any firmware that can be changed by a user of the system is measured by the TPM and confirmed as valid before it executes. This way, the server can recognize if its firmware has been changed improperly and take appropriate action. This could include rolling back a component’s firmware to the last known good version to avoid a service disruption, while also notifying the network administrator that an attempt to compromise the server was stopped but further attention may be required to confirm the server is secure.

Knowing and adopting the pillars of information assurance is the first step in taking a proactive approach to securing a network. The pillars provide network administrators with a high-level understanding of how a properly secured network should operate. Using the pillars as a baseline, network administrators must then stay on top of emerging cyberthreats, like compromised firmware, to understand how they could impact each pillar and how to adapt their security posture to keep such emerging threats at bay.

Kyle Gaede has been with Microchip Technology for nearly 25 years and is currently a principal manager for the company’s segment group with a focus on data centers. Gaede holds a Bachelor of Science in Electrical Engineering from the University of Texas Austin.

<!–
googletag.cmd.push(function() { googletag.display(‘div-gpt-ad-native’); });
–>

The post Strengthening the pillars of information assurance in a world of evolving threats appeared first on EDN.

Strengthening the pillars of information assurance in a world of evolving threats

Become a member

Become a member

Become a subscriber

Become a sponsor