Lesson 12 + 13 Flashcards
hardware Root of Trust (RoT) or trust anchor
hardware Root of Trust (RoT) or trust anchor is a secure subsystem that is able to provide attestation.
The RoT is usually established by a type of cryptoprocessor called a trusted platform module (TPM)
Attestation means that a statement made by the system can be trusted by the receiver.
Attestation
Attestation means that a statement made by the system can be trusted by the receiver.
TPM
TPM is a specification for hardware-based storage of encryption keys, hashed passwords, and other user and platform identification information.
The TPM is implemented either as part of the chipset or as an embedded function of the CPU.
Each TPM is hard-coded with a unique, unchangeable asymmetric private key called the endorsement key.
TPM also supports the concept of an owner, usually identified by a password
Secure boot
Secure boot is designed to prevent a computer from being hijacked by a malicious OS.
Secure boot requires UEFI, but does not require a TPM
unified extensible firmware interface (UEFI)
UEFI provides code that allows the host to boot to an OS. UEFI can enforce a number of boot integrity checks.
A trusted or measured boot
A trusted or measured boot process uses platform configuration registers (PCRs) in the TPM at each stage in the boot process to check whether hashes of key system state data (boot firmware, boot loader, OS kernel, and critical drivers) have changed.
Boot attestation
Boot attestation is the capability to transmit a boot log report signed by the TPM via a trusted process to a remote server, such as a network access control server.
The boot log can be analyzed for signs of compromise, such as the presence of unsigned drivers.
The host can be prevented from accessing the network if it does not meet the required health policy or if no attestation report is received
Memorandum of understanding (MOU)
agreement to express an intent to work together
Business partnership agreement (BPA)
BPA - the partner agreements that large IT companies (such as Microsoft and Cisco) set up with resellers and solution providers.
Non-disclosure agreement (NDA)
Legal basis for protecting information assets. NDAs are used between companies and employees, between companies and contractors, and between two companies.
Service level agreement (SLA)
A contractual agreement sets out the detailed terms under which a service is provided.
Measurement systems analysis (MSA)
quality management processes, such as Six Sigma, make use of quantified analysis methods to determine the effectiveness of a system.
hardening
The process of putting an operating system or application in a secure configuration is called hardening.
Host-based intrusion detection systems (HIDS)
provide threat detection via log and file system monitoring.
An endpoint protection platform (EPP)
An endpoint protection platform (EPP) is a single agent performing multiple security tasks, including malware/intrusion detection and prevention, but also other security features, such as a host firewall, web content filtering/secure search and browsing, and file/message encryption.
data loss prevention (DLP) agent
data loss prevention (DLP) agent. This is configured with policies to identify privileged files and strings that should be kept private or confidential, such as credit card numbers. The agent enforces the policy to prevent data from being copied or attached to a message without authorization.
endpoint detection and response (EDR)
endpoint detection and response (EDR) - provide real-time and historical visibility into the compromise, contain the malware within a single host, and facilitate remediation of the host to its original state.
embedded system
embedded system is a complete computer system that is designed to perform a specific, dedicated function.
Embedded systems can be characterized as static environments. A PC is a dynamic environment.
Embedded systems are normally based on firmware running on a programmable logic controller (PLC).
System on chip (SoC)
System on chip (SoC) is a design where all these processors, controllers, and devices are provided on a single processor die (or chip).
Arduino, Rasperberry PIs are examples of SoC boards.
