Cybersecurity Alone Is Not Enough, Systems Need Cyber Resiliency

Electronics systems today need to go beyond preparedness for an attack to resiliency during and after one.

By Eric Sivertson, VP of Security Business Development, Lattice Semiconductor

The National Vulnerability Database reported that between 2016 and 2019 the number of firmware vulnerabilities grew over 700 percent. Industry analyst group, Gartner, reports that by 2022 “70 percent of organizations that do not have a firmware upgrade plan in place will be breached due to a firmware vulnerability¹.”

Not only do these vulnerabilities jeopardize final products deployed in the field, but they can also impact individual components as they move through today’s rapidly changing and increasingly unpredictable global electronics supply chain, from initial component manufacturing and shipment to a contract manufacturer, to system integration and on through the device’s entire operating life in the field. Firmware vulnerabilities can be exploited by bad actors and expose organizations to different security issues, including data theft, data corruption, unauthorized hardware modification, equipment hijacking, product cloning, ransomware, and design theft. Because such exploits occur below the operating system level, they often go undetected my anti-virus software until the damage is done, potentially having a major impact on a company’s revenue and reputation.

Electronic systems must be able to adapt to new threats as they evolve and automatically take appropriate action when compromised firmware is detected. To protect system firmware, security solutions need resiliency against firmware attacks based on a parallel, real-time, reactive solution that offers comprehensive firmware protection throughout a system’s lifecycle. Firmware protection must span the full life cycle of a component, beginning with the time spent moving through the supply chain, initial product assembly, end-product shipping, integration, through the product’s entire operational life.

While cybersecurity is a widely known necessity, cyber resiliency is still an emerging concept for most organizations. Cybersecurity refers to the technologies, processes, and practices employed to protect network, devices, applications, and data from cyberattacks, Cyber resiliency goes a step further and deals with what is done after an attack takes place. Cyber resiliency is defined as the ability to continuously deliver an intended outcome despite adverse cyber events like an attack. Cyber resiliency embraces information security, business continuity, and overall organizational resilience in today’s rapidly evolving threat landscape.

Cybersecurity is the foundation of cyber resiliency, but cybersecurity is becoming an overloaded term. Take the widely-used cybersecurity solution, the trusted platform module (TPM), as an example. The Trusted Computing Group describes a TPM as a computer chip that can securely store artifacts used to authenticate your PC or laptop, including passwords, certificates, or encryption keys.  This is a strong cybersecurity component but lacks some key features needed to be truly cyber-resilient.

While the TPM concept is certainly an important development in hardware security, it does have vulnerabilities, particularly during cold boot when some firmware elements are required for boot before the TPM typically becomes active. That short window of time between when components on a motherboard are powered up by their firmware and when the OS is an increasingly popular attack vector for today’s cybercriminals. To combat this threat, systems need to implement a Hardware Root of Trust (HRoT) with strong, dynamic, cyber resilient protections in addition to cybersecurity solutions like TPM.

A Cyber-resilient HRoT validates the firmware of each mainboard component before activating it. As it boots the system, the HRoT checks itself to ensure its running valid firmware and holds other system ICs in reset mode until their firmware is cryptographically validated. It is essential to validate firmware before it is loaded into ICs, because malware-infected firmware can mask its presence from the OS once it’s installed itself. In addition to securely booting the hardware, the HRoT continuously monitors other protected components’ firmware against attacks. If corrupted firmware is detected by the HRoT IC, it can quickly replace the corrupt firmware with the last known-good firmware, log the violation for future examination, and resume system operation uninterrupted and un-corrupted. That ability to resume normal operations securely, quickly, and unassisted is what makes the system cyber resilient.

In an increasingly sophisticated threat environment, organizations must take steps to not only secure their systems against cyberthreats, but they must also make their systems resilient enough to mitigate an attack in real-time and maintain the integrity of their firmware automatically.

References:

¹Source: Gartner, July 2019

About the Author

Eric Sivertson is an experienced entrepreneur, executive and engineer with 30+ years developing technologies to enhance trust & security in embedded systems,  wireless connectivity, and high performance & reconfigurable computing. He currently serves as Lattice Semiconductor’s Vice-President of its Security

Business. He is focused on building business in this growth market for Lattice, as well as supporting leading edge solutions development within the organization.

Prior to joining Lattice, he founded his own Security & Consulting Company in Silicon Valley and has been provider and/or advisor to many Silicon Valley Startups and Fortune 500 companies with regards to Security IP and implementations, blockchain, AI/ML based security solutions, markets and critical requirements. Additionally, he was Executive Vice-President of Kontron’s Aviation, Transportation and Defense Business Unit and before that he was General Manager of Xilinx Aerospace and Defense Business Unit. He also ran one of Thales largest North American engineering organizations that developed the world’s most secure and advanced Software Defined Radio (SDR) currently deployed extensively throughout the world. He earned his Electrical Engineering degree from Virginia Polytechnic Institute and State University (BSEE).

Eric can be reached online at eric.sivertson@latticesemi.com and at the company website https://www.latticesemi.com/

FAIR USE NOTICE: Under the “fair use” act, another author may make limited use of the original author’s work without asking permission. Pursuant to 17 U.S. Code § 107, certain uses of copyrighted material “for purposes such as criticism, comment, news reporting, teaching (including multiple copies for classroom use), scholarship, or research, is not an infringement of copyright.” As a matter of policy, fair use is based on the belief that the public is entitled to freely use portions of copyrighted materials for purposes of commentary and criticism. The fair use privilege is perhaps the most significant limitation on a copyright owner’s exclusive rights. Cyber Defense Media Group is a news reporting company, reporting cyber news, events, information and much more at no charge at our website Cyber Defense Magazine. All images and reporting are done exclusively under the Fair Use of the US copyright act.