HSMAttest / What Problem does HSM Attest address?
What Problem does HSM Attest address?
This page is still under development.
What Problem does HSM Attest address?
This page describes the problem that HSM Attest is addressing.
What must be protected?
The problem is to protect sensitive data. What is Sensitive Data?
Sensitive Data can be characterised as data without which the system cannot function and which, in the wrong hands, can lead to major security malfunctions, e.g. Data loss, Data Manipulation, illegitimate (forged) products or actions of the system.
Sensitive data comes with differing levels of required protection. For example a root key protecting an entire database requires more protection than a temporary key protecting a single short lived connection. The level of effort and inconvenience involved in accessing a piece of sensitive data may - and probably will be - more for critical data than for less-critical.
- The most sensitive data held in a system deserves special protection over and above that covering the bulk of the working data in the system.
- There is an overhead in protecting data that makes it ineffective to just declare everything to be sensitive.
- Sensitive Data can cover a number of things, including
- Encryption Keys protecting Data at rest and Data in transit in the system.
- Authentication keys used to prove the identity of system components, both to other system components and externally (e.g. https).
- Data being processed in clear text at a given point in time.
From Whom must it be protected?
Everyone not explicitly permitted by valid and auditable governance decisions. See ThreatMap for some of them.
Application Status Quo
Large applications today are almost all hosted in the cloud or on private on-site servers using the current cloud technology stack. And if not, then the companies owning them are working on moving towards this.
Trust models have not yet caught up with the expanding threat landscape caused by:
- Increased exposure to third parties, especially cloud hosters (hyperscalers) and other customers on the cloud platform.
- Increased standardisation of the technology stack means that attack models and toolsets are becoming increasingly effective as effort is focussed on, and the toolkits are tailored for, these environments.
- High dependency on third party software modules makes it increasingly difficult to avoid importing flaws into stable systems.
- Legacy Trust Models (Perimeter) often include implicit assumptions of trust based on some other trust, e.g. “ services running on the same internal network means that they are a legitimate part of the infrastructure…”.
Changing Threat Awareness
The experience of recent years and a number of high-profile security breaches have led to some changes in how Security and Threats are perceived:
Costs of Security Failure
It has become clear that the costs of a major security breach are no longer to be ignored. In some cases these can destroy an entire company. These costs can include:
- Loss of customer trust (potentially the most severe!)
- Simple liability damages
- Regulatory fines and sometimes criminal charges
Governance
Regulatory and liability changes in recent years have placed more focus on Governance:
- Who is making the security decisions for a system?
- What decisions did they make and why?
- Are records available for forensic evaluations (post facto as well as pre-emptive) of security risks and breaches?
Insiders
There is an increased awareness that threats from actors with legitimate Insider rights (especially Governance) are extremely dangerous and mostly inadequately addressed by legacy security modelling.
Threat Overview
- AI Driven attacks so far have been focussed on systematic surveying of a system structure and known vulnerabilities at a speed and level of detail not previously seen.
- I expect this to develop into multi-vector attacks where intimate exploration of the target system is combined with the environment of the system, personnel, processes and physical infrastructure, and where an attack is tailored to exploit all of these in combination. Including reverse agency, e.g. where the AI tells its' owner to go and do something in the physical world, eg. dustbin diving or war-driving at a particular address...
This mind map shows an overview of some of the major threats that need to be considered when planning a modern IT System (not considering AI yet):
For a detailed analysis of Threats facing a modern IT System, see Threats