CHANCES AND RISKS FOR SECURITY IN MULTICORE PROCESSORS

Size: px
Start display at page:

Download "CHANCES AND RISKS FOR SECURITY IN MULTICORE PROCESSORS"

Transcription

1 CHANCES AND RISKS FOR SECURITY IN MULTICORE PROCESSORS Prof. Dr.-Ing. Georg Sigl Institute for Security in Information Technology Technical University Munich Fraunhofer Research Institution for Applied and Integrated Security AISEC

2 CONTENTS Security in embedded systems Attacks overview Multicore Chances Risks Future secure embedded systems

3 MAIN SECURITY CHALLENGES IN FUTURE (MULTICORE-) EMBEDDED SYSTEMS Security for 10 and more (30) years. Secure autonomous interaction of heterogenous machines (M2M). Protection against manipulation and misuse. Fulfilling security requirements while keeping real time requirements. Consider resource limitations. Managing increasing complexity in embedded systems. Protection of intellectual property (hardware and software) in embedded systems against counterfeiting. Support of adaptation of cyber physical systems through securely adaptable embedded systems.

4 What is the solution? Secure Element : Security module with small attack surface (low complexity) Designed to resist hardware and software attacks Which could be certified Secure Elements tasks: Integrity check / Remote Attestation Authentication / Access control Key storage / Secure memory Examples: Automotive, Smart Grid, Mobile Phones

5 Secure element in cars AISEC integrates a Secure Element in a care in the BMBF Project SEIS (Sicherheit in eingebetteten IP-basierten Systemen) Task: Access control between internal and external IP based network Internet Gateway OEM Server Secure Element

6 Secure Element im Smart Meter The BSI Protection Profile requests a Secure Element in the gateway of a Smart Meter. Secure Element Source: Protection Profile für das Gateway eines Smart Metering Systems;

7 Secure Elements in mobile phones 3 Secure Elements SIM Security chip Secure SD card

8 Attacks

9 Classification of Hardware Attacks Side-channel Probing & Forcing Fault

10 Example: PIN check with 4 digits function pin_verification( digit_entered[1:4] ) if (digit_entered [1]!= PIN_digit[1] ) return(false); if (digit_entered [2]!= PIN_digit[2] ) return(false); if (digit_entered [3]!= PIN_digit[3] ) return(false); if (digit_entered [4]!= PIN_digit[4] ) return(false); return(true)

11 Fault Attack function pin_verification( digit_entered[1:4] ) if (digit_entered [1]!= PIN_digit[1] ) return(false); if (digit_entered [2]!= PIN_digit[2] ) return(false); if (digit_entered [3]!= PIN_digit[3] ) return(false); if (digit_entered [4]!= PIN_digit[4] ) return(false); return(true)

12 Fault Attack with Laser Station

13 Side-channel attack function pin_verification( digit_entered[1:4] ) if (digit_entered [1]!= PIN_digit[1] ) return(false); if (digit_entered [2]!= PIN_digit[2] ) return(false); if (digit_entered [3]!= PIN_digit[3] ) return(false); if (digit_entered [4]!= PIN_digit[4] ) return(false); return(true) I I I I t t t t

14 Measurement Station for Differential Power Analysis

15 Electromagnetic Analysis

16 Classes of Software Attacks Injection of malicious code (e.g. through buffer overflow) Broken authentication / session management (access control) Insufficient separation of different applications (side channel e.g. cache) Security misconfiguration (e.g. no SW update) Insecure cryptographic storage Insufficient transport layer protection (confidentiality, denial of service) Derived from OWASP Top 10: https://www.owasp.org/index.php/category:owasp_top_ten_projec

17 Opportunities through Multicore

18 Opportunities: Redundancy Attack tolerance e.g. Fault injections with laser Inject jump to bypass security checks Modify register content Modify alarm signals Multi-core: Redundant cores to tolerate fault-attacks: e.g. SLE 78 redundant computation, majority voting, monitoring 18

19 Opportunities: Randomization Attack tolerance e.g. side-channel attacks Timing (execution time of cryptographic operations) and power (power consumption) attacks to crack keys Multi-Core Increased resistance against side-channel attacks: e.g. using multi-cores for randomized execution of cryptographic algorithms

20 Opportunities: Separation Take advantage of multi-cores Assign security/safety critical tasks to dedicated security cores (e.g. hardened cores): secure execution environment strict access controls Distribute sensitive functions between different cores to enhance resistance against reverse engineering attacks and side channel attacks

21 Opportunities: Self-monitoring Separate a security core from data processing cores : Trusted OSs in monitoring system Collect data in userland OS (e.g. syscall traces) Securely analyze data to detect misbehavior Dynamic health monitoring Extend Virtual Machine Introspection to enhance malware detection on multi-cores See BMBF project HIVE.

22 Risks through Multicore

23 Risks through Software Attacks Injection of malicious code Shared Resources Integrity measurement (with TPM, e.g.) Secure boot on MC systems? Broken authentication / session management Authentication not implemented: all on same SoC!? Who manages all SW on multicore system? Insufficient separation of different applications Common caches, busses, peripherals, memories,

24 Risks through Software Attacks Security misconfiguration (e.g. no SW update) Could be implemented through security core Insecure cryptographic storage Memory separation? Bandwidth to access secure element? Insufficient transport layer protection Encrypted on-chip networks On-chip authentication and integrity protection

25 Risks through Hardware Attacks Fault attacks No difference to standard cores Side channel attacks Distributed unsecure hardware accelerators which are vulnerable to hardware attacks Cryptographic algorithms are executed on standard cores because performance permits it Probing Unsecure networks on chip Remark: Implementation of hardware security is complex! No methodology for SoC design available

26 Discussion: Architectures of Multicore Systems with Hardware Secure Elements Abstract: Currently PC systems as well as embedded system often contain a hardware secure element. In the PC this is the trusted platform module and in the embedded world we see smart cards (e.g. SIM) like secure elements. In the future we will get very complex Multicore systems. The security architecture of future systems is open. There are many questions, e.g.: Will there be one or many hardware trust anchors How are secure elements integrated in a Multicore system What will be the security architecture of the operating system: secure/trusted boot, virtual or real secure element No dedicated secure elements but distributed security services -

27 What is the right software architecture? Separation Process Virtualization / Sandboxing System Virtualization Secure Monitoring Virtual Machine Introspection for malware detection Attack tolerance Secure OS Trustworthy component Rich OS 3 rd Party Application Android including Dalvik VM L4Linux with Android patches VMM (L4 Microkernel) Multi-core (SoC)

28 What is the right hardware architecture? M2M SIM other System on Chip GSM ID Actuator ID Sensor Trust Core 1 OS Core 2 IO-interfaces Peripherals Core i Core n RAM Flash System on Chip Hardware Security Module

29 From Embedded System to Cyber Physical System Required Privacy Non repudiation Confidentiality + Access Control Authenticity + Integrity Security Services Sensor µcontroller Actuator Embedded System (ES) ES ES Bus; Serial IF ES ES Locally Connected ES Internet Cyber Physical System System Complexity

Secure Embedded Systems eine Voraussetzung für Cyber Physical Systems und das Internet der Dinge

Secure Embedded Systems eine Voraussetzung für Cyber Physical Systems und das Internet der Dinge Secure Embedded Systems eine Voraussetzung für Cyber Physical Systems und das Internet der Dinge Mitgliederversammlung EIKON e.v. 26. Februar 2014 Prof. Dr.-Ing. Georg Sigl Lehrstuhl für Sicherheit in

More information

1. Fault Attacks for Virtual Machines in Embedded Platforms. Supervisor: Dr Konstantinos Markantonakis, K.Markantonakis@rhul.ac.uk

1. Fault Attacks for Virtual Machines in Embedded Platforms. Supervisor: Dr Konstantinos Markantonakis, K.Markantonakis@rhul.ac.uk Proposed PhD Research Areas I am looking for strong PhD candidates to work on the projects listed below. The ideal candidate would have a mix of theoretical and practical skills, achieved a distinction

More information

Vehicular Security Hardware The Security for Vehicular Security Mechanisms

Vehicular Security Hardware The Security for Vehicular Security Mechanisms escrypt GmbH Embedded Security Systemhaus für eingebettete Sicherheit Vehicular Security Hardware The Security for Vehicular Security Mechanisms Marko Wolf, escrypt GmbH Embedded Security Embedded Security

More information

Security in ST : From Company to Products

Security in ST : From Company to Products Security in ST : From Company to Products July 2015 Thierry FENSCH Innovation, Collaboration and Efficiency Director Grenoble Site A global semiconductor leader 2014 revenues of $7.40B Who we are 2 Approximately

More information

APPLIED AND INTEGRATED SECURITY

APPLIED AND INTEGRATED SECURITY APPLIED AND INTEGRATED SECURITY Directors: Claudia Eckert (Managing) Georg Sigl SECURITY RESEARCH IN MUNICH Fraunhofer Institution for Applied and Integrated Security Claudia Eckert Georg Sigl TU München

More information

Embedded Java & Secure Element for high security in IoT systems

Embedded Java & Secure Element for high security in IoT systems Embedded Java & Secure Element for high security in IoT systems JavaOne - September 2014 Anne-Laure SIXOU - ST Thierry BOUSQUET - ST Frédéric VAUTE - Oracle Speakers 2 Anne-Laure SIXOU Smartgrid Product

More information

Hardware Security Modules for Protecting Embedded Systems

Hardware Security Modules for Protecting Embedded Systems Hardware Security Modules for Protecting Embedded Systems Marko Wolf, ESCRYPT GmbH Embedded Security, Munich, Germany André Weimerskirch, ESCRYPT Inc. Embedded Security, Ann Arbor, USA 1 Introduction &

More information

CHASE Survey on 6 Most Important Topics in Hardware Security

CHASE Survey on 6 Most Important Topics in Hardware Security University of Connecticut CHASE Survey on 6 Most Important Topics in Hardware Security Prepared By Prof. M. Tehranipoor Charles H. Knapp Associate Professor in Engineering Innovation Topics! Counterfeit

More information

Side Channel Analysis and Embedded Systems Impact and Countermeasures

Side Channel Analysis and Embedded Systems Impact and Countermeasures Side Channel Analysis and Embedded Systems Impact and Countermeasures Job de Haas Agenda Advances in Embedded Systems Security From USB stick to game console Current attacks Cryptographic devices Side

More information

CycurHSM An Automotive-qualified Software Stack for Hardware Security Modules

CycurHSM An Automotive-qualified Software Stack for Hardware Security Modules CycurHSM An Automotive-qualified Software Stack for Hardware Security Modules Dr. Frederic Stumpf, ESCRYPT GmbH Embedded Security, Stuttgart, Germany 1 Introduction Electronic Control Units (ECU) are embedded

More information

Network Security in Building Networks

Network Security in Building Networks Network Security in Building Networks Prof. Dr. (TU NN) Norbert Pohlmann Institute for Internet Security - if(is) Westphalian University of Applied Sciences Gelsenkirchen, Germany www.if-is.net Content

More information

SECURITY PRACTICES FOR ADVANCED METERING INFRASTRUCTURE Elif Üstündağ Soykan, Seda Demirağ Ersöz 08.05.2014, ICSG 2014

SECURITY PRACTICES FOR ADVANCED METERING INFRASTRUCTURE Elif Üstündağ Soykan, Seda Demirağ Ersöz 08.05.2014, ICSG 2014 SECURITY PRACTICES FOR ADVANCED METERING INFRASTRUCTURE Elif Üstündağ Soykan, Seda Demirağ Ersöz 08.05.2014, ICSG 2014 Table of Contents Introduction AMI Communication Architecture Security Threats Security

More information

The relevance of cyber-security to functional safety of connected and automated vehicles

The relevance of cyber-security to functional safety of connected and automated vehicles The relevance of cyber-security to functional safety of connected and automated vehicles André Weimerskirch University of Michigan Transportation Research Institute (UMTRI) February 12, 2014 Introduction

More information

Applied and Integrated Security. C. Eckert

Applied and Integrated Security. C. Eckert Applied and Integrated Security 1 Joseph von Fraunhofer (1787-1826) Researcher discovery of Fraunhofer Lines in the sun spectrum Inventor new methods of lens processing Entrepreneur head of royal glass

More information

Session ID: Session Classification:

Session ID: Session Classification: Session ID: Session Classification: Protecting Data with Encryption Access Control Protect Sensitive Data Protect and Manage Threats Groundbreaking Malware Resistance Protects the client, data, and corporate

More information

HOW SECURE ARE CURRENT MOBILE OPERATING SYSTEMS?

HOW SECURE ARE CURRENT MOBILE OPERATING SYSTEMS? HOW SECURE ARE CURRENT MOBILE OPERATING SYSTEMS? Tobias Murmann, Heiko Rossnagel Chair of Mobile Commerce and Multilateral Security Johann Wolfgang Goethe-University Frankfurt D-60054 Frankfurt / Main,

More information

Secure Containers. Jan 2015 www.imgtec.com. Imagination Technologies HGI Dec, 2014 p1

Secure Containers. Jan 2015 www.imgtec.com. Imagination Technologies HGI Dec, 2014 p1 Secure Containers Jan 2015 www.imgtec.com Imagination Technologies HGI Dec, 2014 p1 What are we protecting? Sensitive assets belonging to the user and the service provider Network Monitor unauthorized

More information

Secure Services and Quality Testing SST. Security Engineering Privacy by Design Trusted Solutions. Mario Hoffmann. for Service Ecosystems

Secure Services and Quality Testing SST. Security Engineering Privacy by Design Trusted Solutions. Mario Hoffmann. for Service Ecosystems Secure Services and Quality Testing SST Security Engineering Privacy by Design Trusted Solutions for Service Ecosystems Mario Hoffmann Head of Department Fraunhofer AISEC in a nutshell Fraunhofer Profile

More information

What is a Smart Card?

What is a Smart Card? An Introduction to Smart Cards and RFIDs Prof. Keith E. Mayes Keith.Mayes@rhul.ac.uk Director of the ISG - Smart Card Centre www.scc.rhul.ac.uk Learning Objectives (MSc MSc) Identify the various types

More information

UNCLASSIFIED Version 1.0 May 2012

UNCLASSIFIED Version 1.0 May 2012 Secure By Default: Platforms Computing platforms contain vulnerabilities that can be exploited for malicious purposes. Often exploitation does not require a high degree of expertise, as tools and advice

More information

Smartphone Security. A Holistic view of Layered Defenses. David M. Wheeler, CISSP, CSSLP, GSLC. (C) 2012 SecureComm, Inc. All Rights Reserved

Smartphone Security. A Holistic view of Layered Defenses. David M. Wheeler, CISSP, CSSLP, GSLC. (C) 2012 SecureComm, Inc. All Rights Reserved Smartphone Security A Holistic view of Layered Defenses David M. Wheeler, CISSP, CSSLP, GSLC 1 The Smartphone Market The smartphone security market is expected to grow at a rate of 44 percent annually

More information

Verfahren zur Absicherung von Apps. Dr. Ullrich Martini IHK, 4-12-2014

Verfahren zur Absicherung von Apps. Dr. Ullrich Martini IHK, 4-12-2014 Verfahren zur Absicherung von Apps Dr. Ullrich Martini IHK, 4-12-2014 Agenda Introducing G&D Problem Statement Available Security Technologies Smartcard Embedded Secure Element Virtualization Trusted Execution

More information

Credential Management for Cloud Computing

Credential Management for Cloud Computing Credential Management for Cloud Computing Workshop Cloud Security, 16.07.2014 Dr. Johannes Luyken Page 1 Security breaches increase in their impact by exploiting online access to confidential data that

More information

Thick Client Application Security

Thick Client Application Security Thick Client Application Security Arindam Mandal (arindam.mandal@paladion.net) (http://www.paladion.net) January 2005 This paper discusses the critical vulnerabilities and corresponding risks in a two

More information

Secure Wireless Application Platform

Secure Wireless Application Platform Texas Instruments SW@P Secure Wireless Application Platform New Challenges for Wireless Handsets Open Environment Multi-application, Interoperability Multiple Access Data Paths GSM/GPRS, EDGE, 802.11,

More information

R&S MKS9680 Modular Encryption Device Secure voice, fax and data transmission

R&S MKS9680 Modular Encryption Device Secure voice, fax and data transmission Secure Communications Product Brochure 01.01 R&S MKS9680 Modular Encryption Device Secure voice, fax and data transmission R&S MKS9680 Modular Encryption Device At a glance The R&S MKS9680 is a highly

More information

CS 356 Lecture 25 and 26 Operating System Security. Spring 2013

CS 356 Lecture 25 and 26 Operating System Security. Spring 2013 CS 356 Lecture 25 and 26 Operating System Security Spring 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access Control

More information

Reducing Application Vulnerabilities by Security Engineering

Reducing Application Vulnerabilities by Security Engineering Reducing Application Vulnerabilities by Security Engineering - Subash Newton Manager Projects (Non Functional Testing, PT CoE Group) 2008, Cognizant Technology Solutions. All Rights Reserved. The information

More information

A M D DA S 1. 0 For the Manageability, Virtualization and Security of Embedded Solutions

A M D DA S 1. 0 For the Manageability, Virtualization and Security of Embedded Solutions A M D DA S 1. 0 For the Manageability, Virtualization and Security of Embedded Solutions AMD DAS (DASH, AMD Virtualization (AMD-V ) Technology, and Security) 1.0 is a term used to describe the various

More information

Pervasive Computing und. Informationssicherheit

Pervasive Computing und. Informationssicherheit Pervasive Computing und 11. Symposium on Privacy and Security Rüschlikon, 13. September 2006 Prof. Christof Paar European Competence Center for IT Security www.crypto.rub.de Contents 1. Pervasive Computing

More information

Embedding Trust into Cars Secure Software Delivery and Installation

Embedding Trust into Cars Secure Software Delivery and Installation Embedding Trust into Cars Secure Software Delivery and Installation André Adelsbach, Ulrich Huber, Ahmad-Reza Sadeghi, Christian Stüble Horst Görtz Institute for IT Security, Bochum, Germany Third Workshop

More information

International Journal of Scientific & Engineering Research, Volume 5, Issue 1, January-2014 ISSN 2229-5518 1299

International Journal of Scientific & Engineering Research, Volume 5, Issue 1, January-2014 ISSN 2229-5518 1299 1299 TITLE Virtualization security in Data Centres & cloud Prof Sarita Dhawale. Ashoka Center for Business & Computer Studies,Nashik Head of Department of Computer Science University of Pune, Maharashtra.

More information

COURSE NAME: INFORMATION SECURITY INTERNSHIP PROGRAM

COURSE NAME: INFORMATION SECURITY INTERNSHIP PROGRAM COURSE NAME: INFORMATION SECURITY INTERNSHIP PROGRAM Course Description This is the Information Security Training program. The Training provides you Penetration Testing in the various field of cyber world.

More information

Industrie 4.0. Towards a Holistic Approach for Cyber Safety and Security

Industrie 4.0. Towards a Holistic Approach for Cyber Safety and Security Industrie 4.0 Towards a Holistic Approach for Cyber Safety and Security Prof. Dr.-Ing. Reiner Anderl Marco Grimm, M.Sc. Datenverarbeitung in der Konstruktion (DiK) Fachbereich Maschinenbau Technische Universität

More information

W ith an estimated 14 billion devices connected to

W ith an estimated 14 billion devices connected to Renesas Synergy Security Portfolio Delivers Comprehensive Protection from Industrial and IoT Threats Advanced capabilities give developers tools to counter attacks W ith an estimated 14 billion devices

More information

What is Really Needed to Secure the Internet of Things?

What is Really Needed to Secure the Internet of Things? What is Really Needed to Secure the Internet of Things? By Alan Grau, Icon Labs alan.grau@iconlabs.com The Internet of Things (IoT) has become a ubiquitous term to describe the tens of billions of devices

More information

Sierraware Overview. Simply Secure

Sierraware Overview. Simply Secure Sierraware Overview Simply Secure Sierraware Software Suite SierraTEE/Micro Kernel TrustZone/GlobalPlatform TEE SierraVisor: Bare Metal Hypervisor Hypervisor for ARM Para-virtualization, TrustZone Virtualization,

More information

IoT Security Concerns and Renesas Synergy Solutions

IoT Security Concerns and Renesas Synergy Solutions IoT Security Concerns and Renesas Synergy Solutions Simon Moore CTO - Secure Thingz Ltd Agenda Introduction to Secure.Thingz. The Relentless Attack on the Internet of Things Building protection with Renesas

More information

7 Network Security. 7.1 Introduction 7.2 Improving the Security 7.3 Internet Security Framework. 7.5 Absolute Security?

7 Network Security. 7.1 Introduction 7.2 Improving the Security 7.3 Internet Security Framework. 7.5 Absolute Security? 7 Network Security 7.1 Introduction 7.2 Improving the Security 7.3 Internet Security Framework 7.4 Firewalls 7.5 Absolute Security? 7.1 Introduction Security of Communications data transport e.g. risk

More information

ACER ProShield. Table of Contents

ACER ProShield. Table of Contents ACER ProShield Table of Contents Revision History... 3 Legal Notices... 4 Executive Summary... 5 Introduction... 5 Protection against unauthorized access... 6 Why ACER ProShield... 7 ACER ProShield...

More information

Trusted Platforms for Homeland Security

Trusted Platforms for Homeland Security Trusted Platforms for Homeland Security By Kevin Schutz, Product Manager Secure Products Summary Ongoing threats from hackers, viruses, and worms continue to make security a top priority for IT and business

More information

SECURE IMPLEMENTATIONS OF CONTENT PROTECTION (DRM) SCHEMES ON CONSUMER ELECTRONIC DEVICES

SECURE IMPLEMENTATIONS OF CONTENT PROTECTION (DRM) SCHEMES ON CONSUMER ELECTRONIC DEVICES SECURE IMPLEMENTATIONS OF CONTENT PROTECTION (DRM) SCHEMES ON CONSUMER ELECTRONIC DEVICES Contents Introduction... 3 DRM Threat Model... 3 DRM Flow... 4 DRM Assets... 5 Threat Model... 5 Protection of

More information

Java Card. Smartcards. Demos. . p.1/30

Java Card. Smartcards. Demos. . p.1/30 . p.1/30 Java Card Smartcards Java Card Demos Smart Cards. p.2/30 . p.3/30 Smartcards Credit-card size piece of plastic with embedded chip, for storing & processing data Standard applications bank cards

More information

CRYPTOGRAPHY AS A SERVICE

CRYPTOGRAPHY AS A SERVICE CRYPTOGRAPHY AS A SERVICE Peter Robinson RSA, The Security Division of EMC Session ID: ADS R01 Session Classification: Advanced Introduction Deploying cryptographic keys to end points such as smart phones,

More information

Security Issues with Integrated Smart Buildings

Security Issues with Integrated Smart Buildings Security Issues with Integrated Smart Buildings Jim Sinopoli, Managing Principal Smart Buildings, LLC The building automation industry is now at a point where we have legitimate and reasonable concern

More information

Secure USB Flash Drive. Biometric & Professional Drives

Secure USB Flash Drive. Biometric & Professional Drives Secure USB Flash Drive Biometric & Professional Drives I. CONTENTS II. INTRODUCTION... 2 OVERVIEW... 2 COPYRIGHTS AND TRADEMARKS... 2 III. SECURE FLASH DRIVE... 3 DESCRIPTION... 3 IV. MODULES OF SECURE

More information

CRYPTUS DIPLOMA IN IT SECURITY

CRYPTUS DIPLOMA IN IT SECURITY CRYPTUS DIPLOMA IN IT SECURITY 6 MONTHS OF TRAINING ON ETHICAL HACKING & INFORMATION SECURITY COURSE NAME: CRYPTUS 6 MONTHS DIPLOMA IN IT SECURITY Course Description This is the Ethical hacking & Information

More information

Automotive Ethernet Security Testing. Alon Regev and Abhijit Lahiri

Automotive Ethernet Security Testing. Alon Regev and Abhijit Lahiri Automotive Ethernet Security Testing Alon Regev and Abhijit Lahiri 1 Automotive Network Security Cars are evolving Number of ECUs, sensors, and interconnects is growing Moving to Ethernet networks utilizing

More information

Test vehicle tool to assess candidate ITSEF s competency

Test vehicle tool to assess candidate ITSEF s competency Test vehicle tool to assess candidate ITSEF s competency September 28, 2011 Takayuki TOBITA IT Security Center (ISEC) Information-technology Promotion Agency, JAPAN (IPA) 1 Common Criteria Scheme in Japan

More information

A Cryptographically Secure On-chip Firewall for Memory Address Space Control

A Cryptographically Secure On-chip Firewall for Memory Address Space Control A Cryptographically Secure On-chip Firewall for Memory Address Space Control Roberto Rivoir Director of Security Development Rambus France IoT & Security Innovation Day Sophia Antipolis, France 26 November

More information

Criteria for web application security check. Version 2015.1

Criteria for web application security check. Version 2015.1 Criteria for web application security check Version 2015.1 i Content Introduction... iii ISC- P- 001 ISC- P- 001.1 ISC- P- 001.2 ISC- P- 001.3 ISC- P- 001.4 ISC- P- 001.5 ISC- P- 001.6 ISC- P- 001.7 ISC-

More information

Secure Data Exchange Solution

Secure Data Exchange Solution Secure Data Exchange Solution I. CONTENTS I. CONTENTS... 1 II. INTRODUCTION... 2 OVERVIEW... 2 COPYRIGHTS AND TRADEMARKS... 2 III. SECURE DOCUMENT EXCHANGE SOLUTIONS... 3 INTRODUCTION... 3 Certificates

More information

Lecture Embedded System Security A. R. Sadeghi, @TU Darmstadt, 2011 2012 Introduction Mobile Security

Lecture Embedded System Security A. R. Sadeghi, @TU Darmstadt, 2011 2012 Introduction Mobile Security Smartphones and their applications have become an integral part of information society Security and privacy protection technology is an enabler for innovative business models Recent research on mobile

More information

Today. Important From Last Time. Old Joke. Computer Security. Embedded Security. Trusted Computing Base

Today. Important From Last Time. Old Joke. Computer Security. Embedded Security. Trusted Computing Base Important From Last Time A system is safety critical when its failure may result in injuries or deaths Verification and validation can dominate overall development effort Today Embedded system security

More information

True Identity solution

True Identity solution Identify yourself securely. True Identity solution True Identity authentication and authorization for groundbreaking security across multiple applications including all online transactions Biogy Inc. Copyright

More information

Chapter 1: Introduction

Chapter 1: Introduction Chapter 1 Introduction 1 Chapter 1: Introduction 1.1 Inspiration Cloud Computing Inspired by the cloud computing characteristics like pay per use, rapid elasticity, scalable, on demand self service, secure

More information

Overview of the Penetration Test Implementation and Service. Peter Kanters

Overview of the Penetration Test Implementation and Service. Peter Kanters Penetration Test Service @ ABN AMRO Overview of the Penetration Test Implementation and Service. Peter Kanters ABN AMRO / ISO April 2010 Contents 1. Introduction. 2. The history of Penetration Testing

More information

EVITA-Project.org: E-Safety Vehicle Intrusion Protected Applications

EVITA-Project.org: E-Safety Vehicle Intrusion Protected Applications EVITA-Project.org: E-Safety Vehicle Intrusion Protected Applications 7 th escar Embedded Security in Cars Conference November 24 25, 2009, Düsseldorf Dr.-Ing. Olaf Henniger, Fraunhofer SIT Darmstadt Hervé

More information

PCI Security Standards Council

PCI Security Standards Council PCI Security Standards Council Ralph Poore, Director, Emerging Standards 2013 About PCI Emerging Technologies OWASP and Mobile Guidelines About PCI About the PCI Council Open, global forum Founded 2006

More information

Introduction to Cyber Security / Information Security

Introduction to Cyber Security / Information Security Introduction to Cyber Security / Information Security Syllabus for Introduction to Cyber Security / Information Security program * for students of University of Pune is given below. The program will be

More information

Web Application Report

Web Application Report Web Application Report This report includes important security information about your Web Application. Security Report This report was created by IBM Rational AppScan 8.5.0.1 11/14/2012 8:52:13 AM 11/14/2012

More information

Right-Sizing M2M Security: The Best Security is Security Tailored to Your Application

Right-Sizing M2M Security: The Best Security is Security Tailored to Your Application Right-Sizing M2M Security: The Best Security is Security Tailored to Your Application Introduction Security continues to be a hot topic in all areas of technology, including machine-tomachine (M2M) applications.

More information

Start building a trusted environment now... (before it s too late) IT Decision Makers

Start building a trusted environment now... (before it s too late) IT Decision Makers YOU CAN T got HAP Start building a trusted environment now... IT Decision Makers (before it s too late) HAP reference implementations and commercial solutions are available now in the HAP Developer Kit.

More information

ISSN: 2321-7782 (Online) Volume 2, Issue 1, January 2014 International Journal of Advance Research in Computer Science and Management Studies

ISSN: 2321-7782 (Online) Volume 2, Issue 1, January 2014 International Journal of Advance Research in Computer Science and Management Studies ISSN: 2321-7782 (Online) Volume 2, Issue 1, January 2014 International Journal of Advance Research in Computer Science and Management Studies Research Paper Available online at: www.ijarcsms.com New Challenges

More information

Cloud Security:Threats & Mitgations

Cloud Security:Threats & Mitgations Cloud Security:Threats & Mitgations Vineet Mago Naresh Khalasi Vayana 1 What are we gonna talk about? What we need to know to get started Its your responsibility Threats and Remediations: Hacker v/s Developer

More information

Taming the Robot: Efficient Sand-boxing of the Android OS

Taming the Robot: Efficient Sand-boxing of the Android OS Technische Universität Berlin FG Security in Telecommunications Weiss Steffen Liebergeld, March 22nd, 2011 steffen@sec.t-labs.tu-berlin.de Outline Introduction Virtualization Microkernels L4Linux L4 Android

More information

Penetration Testing Windows Vista TM BitLocker TM

Penetration Testing Windows Vista TM BitLocker TM Penetration Testing BitLocker TM Drive Encryption Douglas MacIver Penetration Engineer System Integrity Group, Corporation Hack In The Box 2006/09/21 2006 Corporation. All rights reserved. Trustworthy

More information

INSE 6150 Lecture Notes

INSE 6150 Lecture Notes INSE 6150 Lecture Notes Lecture 11: Human Procedures (cont.) and Hardware Security Course Instructor: Prof. Jeremy Clark Scribed by: Kobra (Ava) Khanmohammadi Concordia University, winter 2014 1. Procedures

More information

Network connectivity controllers

Network connectivity controllers Network connectivity controllers High performance connectivity solutions Factory Automation The hostile environment of many factories can have a significant impact on the life expectancy of PCs, and industrially

More information

Embedded Security for Modern Building Automation Systems

Embedded Security for Modern Building Automation Systems Embedded Security for Modern Building Automation Systems Daniel Höttges, ESCRYPT GmbH Embedded Security, Bochum, Germany Marko Wolf, ESCRYPT GmbH Embedded Security, München, Germany Digitalization and

More information

CARTES 2012 Demo presentation. Secure Trusted Execution Environment

CARTES 2012 Demo presentation. Secure Trusted Execution Environment CARTES 2012 Demo presentation Secure Trusted Execution Environment MobiCore offers a preventive security solution, protecting most of currently known cyber attacks, complementary to other security solutions

More information

WHITE PAPER Security in M2M Communication What is secure enough?

WHITE PAPER Security in M2M Communication What is secure enough? WHITE PAPER Security in M2M Communication What is secure enough? Motivation Wireless Machine-To-Machine (M2M) communication has grown dramatically over the past decade and is still growing rapidly. In

More information

Management of VMware ESXi. on HP ProLiant Servers

Management of VMware ESXi. on HP ProLiant Servers Management of VMware ESXi on W H I T E P A P E R Table of Contents Introduction................................................................ 3 HP Systems Insight Manager.................................................

More information

Firmware security features in HP Compaq business notebooks

Firmware security features in HP Compaq business notebooks HP ProtectTools Firmware security features in HP Compaq business notebooks Embedded security overview... 2 Basics of protection... 2 Protecting against unauthorized access user authentication... 3 Pre-boot

More information

M-Shield mobile security technology

M-Shield mobile security technology Technology for Innovators TM M-Shield mobile security technology making wireless secure Overview As 3G networks are successfully deployed worldwide, opportunities are arising to deliver to end-users a

More information

PUF Physical Unclonable Functions

PUF Physical Unclonable Functions Physical Unclonable Functions Protecting next-generation Smart Card ICs with SRAM-based s The use of Smart Card ICs has become more widespread, having expanded from historical banking and telecommunication

More information

Securely Architecting the Internal Cloud. Rob Randell, CISSP Senior Security and Compliance Specialist VMware, Inc.

Securely Architecting the Internal Cloud. Rob Randell, CISSP Senior Security and Compliance Specialist VMware, Inc. Securely Architecting the Internal Cloud Rob Randell, CISSP Senior Security and Compliance Specialist VMware, Inc. Securely Building the Internal Cloud Virtualization is the Key How Virtualization Affects

More information

What s The Right Security for IoT? IIC (Industrial Internet Consortium) Public Forum Yoshiaki Ujino June 3, 2016

What s The Right Security for IoT? IIC (Industrial Internet Consortium) Public Forum Yoshiaki Ujino June 3, 2016 What s The Right Security for IoT? IIC (Industrial Internet Consortium) Public Forum Yoshiaki Ujino June 3, 2016 Agenda 1 Infineon introduction 2 Introduction to IoT 3 Risk Analysis 4 Countermeasures 5

More information

Security Implications Associated with Mass Notification Systems

Security Implications Associated with Mass Notification Systems Security Implications Associated with Mass Notification Systems Overview Cyber infrastructure: Includes electronic information and communications systems and services and the information contained in these

More information

M2M For industrial and automotive

M2M For industrial and automotive M2M For industrial and automotive Content ST at a glance... 4 Where to find us... 5 The value chain... 5 Secure MCU... 6 Focus on ST33 secure microcontrollers... 6 M2M fields of application... 7 What is

More information

Protecting Your Organisation from Targeted Cyber Intrusion

Protecting Your Organisation from Targeted Cyber Intrusion Protecting Your Organisation from Targeted Cyber Intrusion How the 35 mitigations against targeted cyber intrusion published by Defence Signals Directorate can be implemented on the Microsoft technology

More information

Emerging Network Security Threats and what they mean for internal auditors. December 11, 2013 John Gagne, CISSP, CISA

Emerging Network Security Threats and what they mean for internal auditors. December 11, 2013 John Gagne, CISSP, CISA Emerging Network Security Threats and what they mean for internal auditors December 11, 2013 John Gagne, CISSP, CISA 0 Objectives Emerging Risks Distributed Denial of Service (DDoS) Attacks Social Engineering

More information

3. Broken Account and Session Management. 4. Cross-Site Scripting (XSS) Flaws. Web browsers execute code sent from websites. Account Management

3. Broken Account and Session Management. 4. Cross-Site Scripting (XSS) Flaws. Web browsers execute code sent from websites. Account Management What is an? s Ten Most Critical Web Application Security Vulnerabilities Anthony LAI, CISSP, CISA Chapter Leader (Hong Kong) anthonylai@owasp.org Open Web Application Security Project http://www.owasp.org

More information

Data Protection: From PKI to Virtualization & Cloud

Data Protection: From PKI to Virtualization & Cloud Data Protection: From PKI to Virtualization & Cloud Raymond Yeung CISSP, CISA Senior Regional Director, HK/TW, ASEAN & A/NZ SafeNet Inc. Agenda What is PKI? And Value? Traditional PKI Usage Cloud Security

More information

Virtual Machines for ROC: Initial Impressions. Pete Broadwell

Virtual Machines for ROC: Initial Impressions. Pete Broadwell Virtual Machines for ROC: Initial Impressions Pete Broadwell pbwell@cs.berkeley.edu Talk Outline 1. Virtual Machines & ROC: Common Paths 2. Quick Review of VMware Terminology 3. Case Study: Using VMware

More information

Adobe Systems Incorporated

Adobe Systems Incorporated Adobe Connect 9.2 Page 1 of 8 Adobe Systems Incorporated Adobe Connect 9.2 Hosted Solution June 20 th 2014 Adobe Connect 9.2 Page 2 of 8 Table of Contents Engagement Overview... 3 About Connect 9.2...

More information

TPM Key Backup and Recovery. For Trusted Platforms

TPM Key Backup and Recovery. For Trusted Platforms TPM Key Backup and Recovery For Trusted Platforms White paper for understanding and support proper use of backup and recovery procedures for Trusted Computing Platforms. 2006-09-21 V0.95 Page 1 / 17 Contents

More information

VICTORIA UNIVERSITY OF WELLINGTON Te Whare Wānanga o te Ūpoko o te Ika a Māui

VICTORIA UNIVERSITY OF WELLINGTON Te Whare Wānanga o te Ūpoko o te Ika a Māui VICTORIA UNIVERSITY OF WELLINGTON Te Whare Wānanga o te Ūpoko o te Ika a Māui School of Engineering and Computer Science Te Kura Mātai Pūkaha, Pūrorohiko PO Box 600 Wellington New Zealand Tel: +64 4 463

More information

Introducing the Industrial i.mx25 ARM9 TM Applications Processor

Introducing the Industrial i.mx25 ARM9 TM Applications Processor July, 2009 Introducing the Industrial i.mx25 ARM9 Applications Processor Ethernet, CAN, USB Amanda McGregor i.mx Product Marketing Purpose Introduction Overview of the Freescale i.mx25 family of ARM 9-based

More information

Embedded Virtualization & Cyber Security for Industrial Automation HyperSecured PC-based Control and Operation

Embedded Virtualization & Cyber Security for Industrial Automation HyperSecured PC-based Control and Operation Embedded Virtualization & Cyber Security for Industrial Automation HyperSecured PC-based Control and Operation Industrial controllers and HMIs today mostly lack protective functions for their IT and network

More information

White Paper How Noah Mobile uses Microsoft Azure Core Services

White Paper How Noah Mobile uses Microsoft Azure Core Services NoahMobile Documentation White Paper How Noah Mobile uses Microsoft Azure Core Services The Noah Mobile Cloud service is built for the Microsoft Azure platform. The solutions that are part of the Noah

More information

North Dakota 2013 IT Security Audit Vulnerability Assessment & Penetration Test Project Briefing

North Dakota 2013 IT Security Audit Vulnerability Assessment & Penetration Test Project Briefing North Dakota 2013 IT Security Audit Vulnerability Assessment & Penetration Test Project Briefing Introduction ManTech Project Manager Mark Shaw, Senior Executive Director Cyber Security Solutions Division

More information

NVM memory: A Critical Design Consideration for IoT Applications

NVM memory: A Critical Design Consideration for IoT Applications NVM memory: A Critical Design Consideration for IoT Applications Jim Lipman Sidense Corp. Introduction The Internet of Things (IoT), sometimes called the Internet of Everything (IoE), refers to an evolving

More information

Computer Science. About PaaS Security. Donghoon Kim Henry E. Schaffer Mladen A. Vouk

Computer Science. About PaaS Security. Donghoon Kim Henry E. Schaffer Mladen A. Vouk About PaaS Security Donghoon Kim Henry E. Schaffer Mladen A. Vouk North Carolina State University, USA May 21, 2015 @ ICACON 2015 Outline Introduction Background Contribution PaaS Vulnerabilities and Countermeasures

More information

How to Secure Infrastructure Clouds with Trusted Computing Technologies

How to Secure Infrastructure Clouds with Trusted Computing Technologies How to Secure Infrastructure Clouds with Trusted Computing Technologies Nicolae Paladi Swedish Institute of Computer Science 2 Contents 1. Infrastructure-as-a-Service 2. Security challenges of IaaS 3.

More information

Mingyu Web Application Firewall (DAS- WAF) - - - All transparent deployment for Web application gateway

Mingyu Web Application Firewall (DAS- WAF) - - - All transparent deployment for Web application gateway Mingyu Web Application Firewall (DAS- WAF) - - - All transparent deployment for Web application gateway All transparent deployment Full HTTPS site defense Prevention of OWASP top 10 Website Acceleration

More information

ARM: A Security Opportunity against Advanced Persistent Threats

ARM: A Security Opportunity against Advanced Persistent Threats SESSION ID: CCT-R05 ARM: A Security Opportunity against Advanced Persistent Threats Siddharth Anbalahan Practice Head-Security Testing Paladaion Networks Pvt Ltd. Siddharth.anbalahan@paladion.net Agenda

More information

Networking: EC Council Network Security Administrator NSA

Networking: EC Council Network Security Administrator NSA coursemonster.com/uk Networking: EC Council Network Security Administrator NSA View training dates» Overview The EC-Council's NSA certification looks at network security from a defensive view. The NSA

More information

Threat Modeling. Frank Piessens (Frank.Piessens@cs.kuleuven.be ) KATHOLIEKE UNIVERSITEIT LEUVEN

Threat Modeling. Frank Piessens (Frank.Piessens@cs.kuleuven.be ) KATHOLIEKE UNIVERSITEIT LEUVEN Threat Modeling Frank Piessens (Frank.Piessens@cs.kuleuven.be ) Secappdev 2007 1 Overview Introduction Key Concepts Threats, Vulnerabilities, Countermeasures Example Microsoft s Threat Modeling Process

More information

Security concept for gateway integrity protection within German smart grids

Security concept for gateway integrity protection within German smart grids ASE 2014, ECSaR-Workshop Security concept for gateway integrity protection within German smart grids Prof. Dr. Kai-Oliver Detken 1, Carl-Heinz Genzel 2, Olav Hoffmann 3, Prof. Dr. Richard Sethmann 4 1

More information