Smart Grid Embedded Cyber Security: Ensuring Security While Promoting Interoperability

Size: px
Start display at page:

Download "Smart Grid Embedded Cyber Security: Ensuring Security While Promoting Interoperability"

Transcription

1 Smart Grid Embedded Cyber Security: Ensuring Security While Promoting Interoperability Communications and Embedded Systems Department Southwest Research Institute Gary Ragsdale, Ph.D., P.E. August 24 25, 2010

2 Southwest Research Institute years, founded employees R&D projects/yr. $500M revenue 1200 acres 170 buildings 2.1 million square feet 2009 J. Dan Bates

3 Presentation Objectives Report on the security posture of Smart Grid devices Describe progress made in Smart Grid security Propose a more robust approach to SG security Describe needs for further research and development

4

5 What is Smart Grid Infrastructure Assessment? Security analysis of smart grid systems & communications Reverse engineering Penetration testing Threat and risk assessment Advanced security methods Power analysis for key discovery Hardware attacks such as decapping chips Developing vulnerability exploits

6 Hacking Proprietary Smart Meters Recovery of crypto keys, security tokens, & passwords via physical attacks on hardware Firmware extraction through debug interfaces and monitoring of system state with In-Circuit Emulators (ICE) Firmware Analysis, Reverse Engineering, and Modification Physical Bus Snooping and Traffic Injection Traffic capture, spoofing, and denial of service attacks on radios

7 Proprietary SG Built with Off-the-Shelf Technology Off-the-shelf microcontrollers Reference electronics design kits Chip specifications and application notes Software development and debug tools Programming and maintenance tools Off-the-shelf communications technology Radio electronics & protocol kits & documentation Software-defined radio development tools Communication protocols simulators

8 Implementing TCG Standards Within Systems Trusted Platform Module (TPM) Provides root of trust Secure storage Signing & hashing functions Tamper detection Accelerates cryptography TPM software stack Implements TCG stack Manages TPM chip

9 Typical Trusted Computing Platform Trust Hierarchy Device Root of Trust (trusted platform electronics) Secure secret storage TPM chip root trust secret Owner root trust secret Memory hash signature Standard encryption algorithm Standard hashing algorithm Tamper detection indicators Data Exchange Session Control (public-private key) Boot Loader Integrity (memory hash) Key Rotation Session Control (public-private key) Software Update Session Control (public-private key) Data Exchange Session Security (symmetric key) Code and Data Integrity (memory hash) Software Update Session Security (symmetric key)

10 Prototypical SG Trusted Computing Platform Phytec with Expansion Board Opal Kelly FPGA with Expansion Board Atmel TPM chip mounted on prototyping board

11 Building an Trusted, Open Smart Grid Device Applications Device Application Software Crypto Service Provider (CSP) MatrixSSL TCG Software Stack (TSS) Trusted Device Driver Library (TDDL) libtpm libtpm TSS integration Device Driver TPM Device Linux kernel Atmel AT97SC3203 * Wave Systems Corp. Platform Specific

12 Building an Trusted, Open Smart Grid Device Market Requirements Applications Proprietary Software Generic Cyber Security Requirements Crypto Service Provider (CSP) TCG Software Stack (TSS) Trusted Device Driver Library (TDDL) Device Driver TPM Device Open Standards & Open Source Software * Wave Systems Corp.

13 Dynamic Data Flow Analysis System Architecture Application C Program DDFA Compiler System Static Analysis Instrumentation Engine Dynamically Policed C Program Policy Specification Translator DDFA Runtime Library Security Policies Test Policies Fault Tolerance Policies

14 Development with DDFA Security policy separate from source code Static dataflow analysis minimizes instrumentation Runtime library provides the dynamic data flow analysis capability DDFA Runtime Library Policy and dynamic data flow analysis provide customized error mitigation DDFA Compiler Security Policed C Code Conventional Compiler Security Policed Executable

15 Need for Smart Grid Security R&D Ongoing threat & risk assessment of new SG devices Enhanced decapping protections for TPM modules Increased RD&T for open source, TCG stack Enhancements to the DDFA compiler Support for more languages within the DDFA compiler Addition of new DDFA fight through attack policies

16 Questions and Answers

Atmel Trusted Platform Module June, 2014

Atmel Trusted Platform Module June, 2014 Atmel Trusted Platform Module June, 2014 1 2014 Atmel Corporation What is a TPM? The TPM is a hardware-based secret key generation and storage device providing a secure vault for any embedded system Four

More information

Connecting Securely to the Cloud

Connecting Securely to the Cloud Connecting Securely to the Cloud Security Primer Presented by Enrico Gregoratto Andrew Marsh Agenda 2 Presentation Speaker Trusting The Connection Transport Layer Security Connecting to the Cloud Enrico

More information

Windows 10 IoT Core Azure Connectivity and Security

Windows 10 IoT Core Azure Connectivity and Security Windows 10 IoT Core Azure Connectivity and Security Published July 27, 2016 Version 1.0 Table of Contents Introduction... 2 Device identities... 2 Building security into the platform... 3 Security as a

More information

Trusted Platform Module explained

Trusted Platform Module explained Bosch Security Systems Video Systems Trusted Platform Module explained What it is, what it does and what its benefits are 3 August 2016 2 Bosch Security Systems Video Systems Table of contents Table of

More information

#RSAC #RSAC Thing Thing Thing Thing Thing Thing Edge Edge Gateway Gateway Cut costs Create value Find information in data then act Maintain Things Enrol Authorized Users & Things Authentication

More information

Securing IoT devices with STM32 & STSAFE Products family. Fabrice Gendreau Secure MCUs Marketing & Application Managers EMEA Region

Securing IoT devices with STM32 & STSAFE Products family. Fabrice Gendreau Secure MCUs Marketing & Application Managers EMEA Region Securing IoT devices with STM32 & STSAFE Products family Fabrice Gendreau Secure MCUs Marketing & Application Managers EMEA Region 2 The leading provider of products and solutions for Smart Driving and

More information

Technical Brief Distributed Trusted Computing

Technical Brief Distributed Trusted Computing Technical Brief Distributed Trusted Computing Josh Wood Look inside to learn about Distributed Trusted Computing in Tectonic Enterprise, an industry-first set of technologies that cryptographically verify,

More information

ARM TrustZone for ARMv8-M for software engineers

ARM TrustZone for ARMv8-M for software engineers ARM TrustZone for ARMv8-M for software engineers Ashok Bhat Product Manager, HPC and Server tools ARM Tech Symposia India December 7th 2016 The need for security Communication protection Cryptography,

More information

Security of Embedded Hardware Systems Insight into Attacks and Protection of IoT Devices

Security of Embedded Hardware Systems Insight into Attacks and Protection of IoT Devices Security of Embedded Hardware Systems Insight into Attacks and Protection of IoT Devices Dr. Johann Heyszl, Head of Hardware Security Department Fraunhofer-Institute for Applied and Integrated Security

More information

Certified Secure Web Application Engineer

Certified Secure Web Application Engineer Certified Secure Web Application Engineer ACCREDITATIONS EXAM INFORMATION The Certified Secure Web Application Engineer exam is taken online through Mile2 s Assessment and Certification System ( MACS ),

More information

SECURITY OF CPS: SECURE EMBEDDED SYSTEMS AS A BASIS

SECURITY OF CPS: SECURE EMBEDDED SYSTEMS AS A BASIS SECURITY OF CPS: SECURE EMBEDDED SYSTEMS AS A BASIS Christoph Krauß, christoph.krauss@aisec.fraunhofer.de Dagstuhl Seminar 11441: Science and Engineering of CPS, November 2011 Overview Introduction Securing

More information

Trusted Computing Today: Benefits and Solutions

Trusted Computing Today: Benefits and Solutions Trusted Computing Today: Benefits and Solutions Brian D. Berger EVP Marketing & Sales Wave Systems Corp. bberger@wavesys.com Copyright 2009 Trusted Computing Group Agenda TCG Vision TCG Benefits Solution

More information

UNCLASSIFIED//FOR OFFICIAL USE ONLY INDUSTRIAL CONTROL SYSTEMS CYBER EMERGENCY RESPONSE TEAM

UNCLASSIFIED//FOR OFFICIAL USE ONLY INDUSTRIAL CONTROL SYSTEMS CYBER EMERGENCY RESPONSE TEAM ADVISORY ICSA-10-019-01 ZIGBEE PSEUDORANDOM NUMBER GENERATOR VULNERABILITY January 19, 2010 OVERVIEW On January 09, 2010, a security researcher published an attack on a ChipCon (CC) implementation of ZigBee

More information

Trusted Computing Group

Trusted Computing Group Trusted Computing Group Backgrounder May 2003 Copyright 2003 Trusted Computing Group (www.trustedcomputinggroup.org.) All Rights Reserved Trusted Computing Group Enabling the Industry to Make Computing

More information

Software Vulnerability Assessment & Secure Storage

Software Vulnerability Assessment & Secure Storage Software Vulnerability Assessment & Secure Storage 1 Software Vulnerability Assessment Vulnerability assessment is the process of identifying flaws that reside in an OS, application software or devices

More information

Creating the Complete Trusted Computing Ecosystem:

Creating the Complete Trusted Computing Ecosystem: FEBRUARY 2018 Creating the Complete Trusted Computing Ecosystem: An Overview of the Trusted Software Stack (TSS) 2.0 Trusted Computing Group 3855 SW 153rd Drive Beaverton, OR 97003 Tel (503) 619-0562 Fax

More information

The Next Steps in the Evolution of Embedded Processors

The Next Steps in the Evolution of Embedded Processors The Next Steps in the Evolution of Embedded Processors Terry Kim Staff FAE, ARM Korea ARM Tech Forum Singapore July 12 th 2017 Cortex-M Processors Serving Connected Applications Energy grid Automotive

More information

Cyber Moving Targets. Yashar Dehkan Asl

Cyber Moving Targets. Yashar Dehkan Asl Cyber Moving Targets Yashar Dehkan Asl Introduction An overview of different cyber moving target techniques, their threat models, and their technical details. Cyber moving target technique: Defend a system

More information

Lecture Secure, Trusted and Trustworthy Computing Trusted Platform Module

Lecture Secure, Trusted and Trustworthy Computing Trusted Platform Module 1 Lecture Secure, Trusted and Trustworthy Computing Trusted Platform Module Prof. Dr.-Ing. Ahmad-Reza Sadeghi System Security Lab Technische Universität Darmstadt Germany Winter Term 2017/18 Roadmap: TPM

More information

Security+ SY0-501 Study Guide Table of Contents

Security+ SY0-501 Study Guide Table of Contents Security+ SY0-501 Study Guide Table of Contents Course Introduction Table of Contents About This Course About CompTIA Certifications Module 1 / Threats, Attacks, and Vulnerabilities Module 1 / Unit 1 Indicators

More information

Securing IoT devices with Hardware Secure Element. Fabrice Gendreau EMEA Secure MCUs Marketing & Application Manager

Securing IoT devices with Hardware Secure Element. Fabrice Gendreau EMEA Secure MCUs Marketing & Application Manager Securing IoT devices with Hardware Secure Element Fabrice Gendreau EMEA Secure MCUs Marketing & Application Manager 2 A global semiconductor leader 2016 revenues of $6.97B Listed: NYSE, Euronext Paris

More information

IDACCS Wireless Integrity protection in a smart grid environment for wireless access of smart meters

IDACCS Wireless Integrity protection in a smart grid environment for wireless access of smart meters IDACCS Wireless 2014 Integrity protection in a smart grid environment for wireless access of smart meters Prof- Dr.-Ing. Kai-Oliver Detken DECOIT GmbH Fahrenheitstraße 9 D-28359 Bremen URL: http://www.decoit.de

More information

Lecture Embedded System Security Trusted Platform Module

Lecture Embedded System Security Trusted Platform Module 1 Lecture Embedded System Security Prof. Dr.-Ing. Ahmad-Reza Sadeghi System Security Lab Technische Universität Darmstadt (CASED) Germany Summer Term 2015 Roadmap: TPM Introduction to TPM TPM architecture

More information

TRESCCA Trustworthy Embedded Systems for Secure Cloud Computing

TRESCCA Trustworthy Embedded Systems for Secure Cloud Computing TRESCCA Trustworthy Embedded Systems for Secure Cloud Computing IoT Week 2014, 2014 06 17 Ignacio García Wellness Telecom Outline Welcome Motivation Objectives TRESCCA client platform SW framework for

More information

Lecture Secure, Trusted and Trustworthy Computing Trusted Platform Module

Lecture Secure, Trusted and Trustworthy Computing Trusted Platform Module 1 Lecture Secure, Trusted and Trustworthy Computing Trusted Platform Module Prof. Dr.-Ing. Ahmad-Reza Sadeghi System Security Lab Technische Universität Darmstadt Germany Winter Term 2016/17 Roadmap: TPM

More information

CSWAE Certified Secure Web Application Engineer

CSWAE Certified Secure Web Application Engineer CSWAE Certified Secure Web Application Engineer Overview Organizations and governments fall victim to internet based attacks every day. In many cases, web attacks could be thwarted but hackers, organized

More information

Improving Security in Embedded Systems Felix Baum, Product Line Manager

Improving Security in Embedded Systems Felix Baum, Product Line Manager Improving Security in Embedded Systems Felix Baum, Product Line Manager The Challenge with Embedded Security Business Imperatives Security Imperatives I need to keep my production expenses as low as possible.

More information

SIDE CHANNEL ATTACKS AGAINST IOS CRYPTO LIBRARIES AND MORE DR. NAJWA AARAJ HACK IN THE BOX 13 APRIL 2017

SIDE CHANNEL ATTACKS AGAINST IOS CRYPTO LIBRARIES AND MORE DR. NAJWA AARAJ HACK IN THE BOX 13 APRIL 2017 SIDE CHANNEL ATTACKS AGAINST IOS CRYPTO LIBRARIES AND MORE DR. NAJWA AARAJ HACK IN THE BOX 13 APRIL 2017 WHAT WE DO What we do Robust and Efficient Cryptographic Protocols Research in Cryptography and

More information

Security in sensors, an important requirement for embedded systems

Security in sensors, an important requirement for embedded systems Security in sensors, an important requirement for embedded systems Georg Sigl Institute for Security in Information Technology Technical University Munich sigl@tum.de Fraunhofer AISEC Institute for Applied

More information

Course overview. CompTIA Security+ Certification (Exam SY0-501) Study Guide (G635eng v107)

Course overview. CompTIA Security+ Certification (Exam SY0-501) Study Guide (G635eng v107) Overview This course is intended for those wishing to qualify with CompTIA Security+. CompTIA's Security+ Certification is a foundation-level certificate designed for IT administrators with 2 years' experience

More information

Trusted Platform Modules Automotive applications and differentiation from HSM

Trusted Platform Modules Automotive applications and differentiation from HSM Trusted Platform Modules Automotive applications and differentiation from HSM Cyber Security Symposium 2017, Stuttgart Martin Brunner, Infineon Technologies Axiom: Whatever is connected can (and will)

More information

Trustzone Security IP for IoT

Trustzone Security IP for IoT Trustzone Security IP for IoT Udi Maor CryptoCell-7xx product manager Systems & Software Group ARM Tech Forum Singapore July 12 th 2017 Why is getting security right for IoT so important? When our everyday

More information

Server side management system for multiple IoT terminals in industrial systems

Server side management system for multiple IoT terminals in industrial systems Infineon Network Use Case Server side management system for multiple IoT terminals in industrial systems This system utilizes the technology of the Trusted Computing Group (TCG) as a time-to-market solution

More information

Trusted Computing As a Solution!

Trusted Computing As a Solution! Trusted Computing As a Solution! Brian Berger EVP Marketing & Sales & TCG Director Wave Systems Corp. www.wave.com Trusted Computing Group www.trustedcomputinggroup.org Agenda State of Hardware Security

More information

Securing IoT with the ARM mbed ecosystem

Securing IoT with the ARM mbed ecosystem Securing IoT with the ARM mbed ecosystem Xiao Sun / Senior Applications Engineer / ARM ARM mbed Connect / Shenzhen, China December 5, 2016 Lots of interest in IoT security Researchers are looking into

More information

ACS / Computer Security And Privacy. Fall 2018 Mid-Term Review

ACS / Computer Security And Privacy. Fall 2018 Mid-Term Review ACS-3921-001/4921-001 Computer Security And Privacy Fall 2018 Mid-Term Review ACS-3921/4921-001 Slides Used In The Course A note on the use of these slides: These slides has been adopted and/or modified

More information

Security in NFC Readers

Security in NFC Readers Security in Readers Public Content and security, a different kind of wireless Under the hood of based systems Enhancing the security of an architecture Secure data exchange Information security goals Cryptographic

More information

ARM Security Solutions and Numonyx Authenticated Flash

ARM Security Solutions and Numonyx Authenticated Flash ARM Security Solutions and Numonyx Authenticated Flash How to integrate Numonyx Authenticated Flash with ARM TrustZone* for maximum system protection Introduction Through a combination of integrated hardware

More information

NGSCB The Next-Generation Secure Computing Base. Ellen Cram Lead Program Manager Windows Security Microsoft Corporation

NGSCB The Next-Generation Secure Computing Base. Ellen Cram Lead Program Manager Windows Security Microsoft Corporation NGSCB The Next-Generation Secure Computing Base Ellen Cram Lead Program Manager Windows Security Microsoft Corporation ellencr@microsoft.com Agenda NGSCB Features Writing NGSCB Agents NGSCB development

More information

New Approaches to Connected Device Security

New Approaches to Connected Device Security New Approaches to Connected Device Security Erik Jacobson Architecture Marketing Director Arm Arm Techcon 2017 - If you connect it to the Internet, someone will try to hack it. - If what you put on the

More information

Survey of Cyber Moving Targets. Presented By Sharani Sankaran

Survey of Cyber Moving Targets. Presented By Sharani Sankaran Survey of Cyber Moving Targets Presented By Sharani Sankaran Moving Target Defense A cyber moving target technique refers to any technique that attempts to defend a system and increase the complexity of

More information

Security Fundamentals

Security Fundamentals COMP 150-IDS: Internet Scale Distributed Systems (Spring 2015) Security Fundamentals Noah Mendelsohn Tufts University Email: noah@cs.tufts.edu Web: http://www.cs.tufts.edu/~noah Copyright 2012 & 2015 Noah

More information

Automotive Security An Overview of Standardization in AUTOSAR

Automotive Security An Overview of Standardization in AUTOSAR Automotive Security An Overview of Standardization in AUTOSAR Dr. Marcel Wille 31. VDI/VW-Gemeinschaftstagung Automotive Security 21. Oktober 2015, Wolfsburg Hackers take over steering from smart car driver

More information

Easy Incorporation of OPTIGA TPMs to Support Mission-Critical Applications

Easy Incorporation of OPTIGA TPMs to Support Mission-Critical Applications Infineon Network Use Case Easy Incorporation of OPTIGA TPMs to Support Mission-Critical Applications Providing Infineon customers with an easy path to integrating TPM support into their products and systems

More information

DesignWare IP for IoT SoC Designs

DesignWare IP for IoT SoC Designs DesignWare IP for IoT SoC Designs The Internet of Things (IoT) is connecting billions of intelligent things at our fingertips. The ability to sense countless amounts of information that communicates to

More information

OVAL + The Trusted Platform Module

OVAL + The Trusted Platform Module OVAL + The Trusted Platform Module Charles Schmidt June 14, 2010 Overview OVAL Can assess a vast diversity of system state Usually software based software attacks can compromise Trusted Platform Module

More information

18-642: Security Vulnerabilities

18-642: Security Vulnerabilities 18-642: Security Vulnerabilities 11/20/2017 Security Vulnerabilities Anti-Patterns for vulnerabilities Ignoring vulnerabilities until attacked Assuming vulnerabilities won t be exploited: Unsecure embedded

More information

Provisioning secure Identity for Microcontroller based IoT Devices

Provisioning secure Identity for Microcontroller based IoT Devices Provisioning secure Identity for Microcontroller based IoT Devices Mark Schaeffer, Sr. Product Marketing Manager, Security Solutions Synergy IoT Platform Business Division, Renesas Electronics, Inc. May

More information

Cybersecurity Challenges for Connected and Automated Vehicles. Robert W. Heller, Ph.D. Program Director R&D, Southwest Research Institute

Cybersecurity Challenges for Connected and Automated Vehicles. Robert W. Heller, Ph.D. Program Director R&D, Southwest Research Institute Cybersecurity Challenges for Connected and Automated Vehicles Robert W. Heller, Ph.D. Program Director R&D, Southwest Research Institute Cars are becoming complex (and CAV is only part of it) 1965: No

More information

The Future of Security is in Open Silicon Linux Security Summit 2018

The Future of Security is in Open Silicon Linux Security Summit 2018 The Future of Security is in Open Silicon Linux Security Summit 2018 Joel Wittenauer - Embedded Software Architect Rambus Cryptography Research August 28, 2018 Agenda About Rambus Cryptography Research

More information

SECURITY CRYPTOGRAPHY Cryptography Overview Brochure. Cryptography Overview

SECURITY CRYPTOGRAPHY Cryptography Overview Brochure. Cryptography Overview SECURITY CRYPTOGRAPHY Cryptography Overview Brochure Cryptography Overview DPA-resistant and Standard Cryptographic Hardware Cores DPA (Differential Power Analysis) Resistant Hardware Cores prevent against

More information

Trusted Computing in Drives and Other Peripherals Michael Willett TCG and Seagate 12 Sept TCG Track: SEC 502 1

Trusted Computing in Drives and Other Peripherals Michael Willett TCG and Seagate 12 Sept TCG Track: SEC 502 1 Trusted Computing in Drives and Other Peripherals Michael Willett TCG and Seagate 12 Sept 2005 TCG Track: SEC 502 1 The Need for Trusted Computing 2 The Real World Innovation is needed: Client software

More information

3 CERTIFICATION AUTHORITY KEY PROTECTION (HSMS)

3 CERTIFICATION AUTHORITY KEY PROTECTION (HSMS) 3 CERTIFICATION AUTHORITY KEY PROTECTION (HSMS) 3.1 Introduction In any public key infrastructure deployment, the protection of private key material (application keys) associated with the public/private

More information

Internet of Things Security standards

Internet of Things Security standards Internet of Things Security standards Vangelis Gazis (vangelis.gazis@huawei.com) Chief Architect Security Internet of Things (IoT) Security Solution Planning & Architecture Design (SPD) Security standards

More information

INTRODUCTION TO CLOAKWARE/TRS TECHNOLOGY

INTRODUCTION TO CLOAKWARE/TRS TECHNOLOGY INTRODUCTION TO CLOAKWARE/TRS TECHNOLOGY VERSION 2.2 OCTOBER 2001 SUMMARY Software is easy to tamper with and reverse engineer so unprotected software deployed on malicious hosts can t be trusted by corporations

More information

CSI: VIDEO SURVEILLANCE CONVERTING THE JUGGERNAUT

CSI: VIDEO SURVEILLANCE CONVERTING THE JUGGERNAUT CSI: VIDEO SURVEILLANCE CONVERTING THE JUGGERNAUT The Market and the Trend Cyber security market (2020): USD 170.21 billion, CAGR ~10% Storage market (2020): USD 18.28 billion, CAGR 22% Tons of data to

More information

A Developer's Guide to Security on Cortex-M based MCUs

A Developer's Guide to Security on Cortex-M based MCUs A Developer's Guide to Security on Cortex-M based MCUs 2018 Arm Limited Nazir S Arm Tech Symposia India Agenda Why do we need security? Types of attacks and security assessments Introduction to TrustZone

More information

MICROCIRCUIT SECURITY

MICROCIRCUIT SECURITY MICROCIRCUIT SECURITY Everything begins in the chip. Sawblade Ventures, LLC Austin, Texas Chip Security Vulnerability: How to Close the Gap Between Design Software & Design Hardware CTEA Electronics Symposium

More information

UNCLASSIFIED R-1 ITEM NOMENCLATURE FY 2013 OCO

UNCLASSIFIED R-1 ITEM NOMENCLATURE FY 2013 OCO Exhibit R-2, RDT&E Budget Item Justification: PB 2013 Office of Secretary Of Defense DATE: February 2012 0400: Research,, Test & Evaluation, Defense-Wide BA 3: Advanced Technology (ATD) COST ($ in Millions)

More information

CASP CompTIA Advanced Security Practitioner Study Guide: (Exam CAS-001)

CASP CompTIA Advanced Security Practitioner Study Guide: (Exam CAS-001) CASP CompTIA Advanced Security Practitioner Study Guide: (Exam CAS-001) Gregg, Michael ISBN-13: 9781118083192 Table of Contents Foreword xxi Introduction xxvii Assessment Test xliv Chapter 1 Cryptographic

More information

Considering the Security of Mobile Commerce and Banking. Professor Keith Mayes Information Security Group ACE-CSR

Considering the Security of Mobile Commerce and Banking. Professor Keith Mayes Information Security Group ACE-CSR Considering the Security of Mobile Commerce and Banking Professor Keith Mayes Information Security Group ACE-CSR Information Security Group (ISG) Established 1992 17 Full-time Academics, 8+ Research Assistants

More information

TPM v.s. Embedded Board. James Y

TPM v.s. Embedded Board. James Y TPM v.s. Embedded Board James Y What Is A Trusted Platform Module? (TPM 1.2) TPM 1.2 on the Enano-8523 that: How Safe is your INFORMATION? Protects secrets from attackers Performs cryptographic functions

More information

9/30/2016. Cryptography Basics. Outline. Encryption/Decryption. Cryptanalysis. Caesar Cipher. Mono-Alphabetic Ciphers

9/30/2016. Cryptography Basics. Outline. Encryption/Decryption. Cryptanalysis. Caesar Cipher. Mono-Alphabetic Ciphers Cryptography Basics IT443 Network Security Administration Slides courtesy of Bo Sheng Basic concepts in cryptography systems Secret cryptography Public cryptography 1 2 Encryption/Decryption Cryptanalysis

More information

Security Requirements for Crypto Devices

Security Requirements for Crypto Devices Security Requirements for Crypto Devices Version 1.0 02 May 2018 Controller of Certifying Authorities Ministry of Electronics and Information Technology 1 Document Control Document Name Security Requirements

More information

Trusted Execution Environments (TEE) and the Open Trust Protocol (OTrP) Hannes Tschofenig and Mingliang Pei 16 th July IETF 99 th, Prague

Trusted Execution Environments (TEE) and the Open Trust Protocol (OTrP) Hannes Tschofenig and Mingliang Pei 16 th July IETF 99 th, Prague Trusted Execution Environments (TEE) and the Open Trust Protocol (OTrP) Hannes Tschofenig and Mingliang Pei 16 th July 2017 -- IETF 99 th, Prague 2 What do we mean by security? Communication Security Aims

More information

Automotive Cybersecurity: Why is it so Difficult? Steven W. Dellenback, Ph.D. Vice President R&D Intelligent Systems Division

Automotive Cybersecurity: Why is it so Difficult? Steven W. Dellenback, Ph.D. Vice President R&D Intelligent Systems Division Automotive Cybersecurity: Why is it so Difficult? Steven W. Dellenback, Ph.D. Vice President R&D Intelligent Systems Division Cybersecurity is not one Entry Point Four Major Aspects of Cybersecurity How

More information

CYBERSECURITY AND SERVICE STATIONS

CYBERSECURITY AND SERVICE STATIONS CYBERSECURITY AND SERVICE STATIONS Hocine AMEUR and Simon Elrharbi hocine.ameur@coessi.fr simon.elrharbi@coessi.fr 1 AGENDA 1. WHO WE ARE 2. IoT and Security 3. Connected service stations security 4. How

More information

High-Assurance Cyber Space Systems (HACSS) for Small Satellite Mission Integrity

High-Assurance Cyber Space Systems (HACSS) for Small Satellite Mission Integrity Distribution A: SSC17-V-01 High-Assurance Cyber Space Systems (HACSS) for Small Satellite Mission Integrity Daria C. Lane, Enrique S. Leon, Francisco C. Tacliad, Dexter H. Solio, Ian L. Rodney, Dmitriy

More information

OpenWay by Itron Security Overview

OpenWay by Itron Security Overview Itron White Paper OpenWay by Itron OpenWay by Itron Security Overview Kip Gering / R. Eric Robinson Itron Marketing / Itron Engineering 2009, Itron Inc. All rights reserved. 1 Executive Summary 3 Intent

More information

Advanced Diploma on Information Security

Advanced Diploma on Information Security Course Name: Course Duration: Prerequisites: Course Fee: Advanced Diploma on Information Security 300 Hours; 12 Months (10 Months Training + 2 Months Project Work) Candidate should be HSC Pass & Basic

More information

Embedded/Connected Device Secure Coding. 4-Day Course Syllabus

Embedded/Connected Device Secure Coding. 4-Day Course Syllabus Embedded/Connected Device Secure Coding 4-Day Course Syllabus Embedded/Connected Device Secure Coding 4-Day Course Course description Secure Programming is the last line of defense against attacks targeted

More information

Terra: A Virtual Machine-Based Platform for Trusted Computing by Garfinkel et al. (Some slides taken from Jason Franklin s 712 lecture, Fall 2006)

Terra: A Virtual Machine-Based Platform for Trusted Computing by Garfinkel et al. (Some slides taken from Jason Franklin s 712 lecture, Fall 2006) Terra: A Virtual Machine-Based Platform for Trusted Computing by Garfinkel et al. (Some slides taken from Jason Franklin s 712 lecture, Fall 2006) Trusted Computing Hardware What can you do if you have

More information

Certifying Program Execution with Secure Processors. Benjie Chen Robert Morris Laboratory for Computer Science Massachusetts Institute of Technology

Certifying Program Execution with Secure Processors. Benjie Chen Robert Morris Laboratory for Computer Science Massachusetts Institute of Technology Certifying Program Execution with Secure Processors Benjie Chen Robert Morris Laboratory for Computer Science Massachusetts Institute of Technology Motivation All PCs may soon include trusted computing

More information

ISACA CISA. ISACA CISA ( Certified Information Systems Auditor ) Download Full Version :

ISACA CISA. ISACA CISA ( Certified Information Systems Auditor ) Download Full Version : ISACA CISA ISACA CISA ( Certified Information Systems Auditor ) Download Full Version : http://killexams.com/pass4sure/exam-detail/cisa QUESTION: 390 Applying a digital signature to data traveling in a

More information

Vulnerability Assessment in Smart Grids. Jinyuan Stella Sun UTK Fall 2016

Vulnerability Assessment in Smart Grids. Jinyuan Stella Sun UTK Fall 2016 Vulnerability Assessment in Smart Grids Jinyuan Stella Sun UTK Fall 2016 Background Roadmap Contents Vulnerability Assessment of Phasor Networks Defense and countermeasures 2 Background The advent of Smart

More information

Security+ Guide to Network Security Fundamentals, Third Edition. Chapter 9 Performing Vulnerability Assessments

Security+ Guide to Network Security Fundamentals, Third Edition. Chapter 9 Performing Vulnerability Assessments Security+ Guide to Network Security Fundamentals, Third Edition Chapter 9 Performing Vulnerability Assessments Objectives Define risk and risk management Describe the components of risk management List

More information

TCG TPM2 Software Stack & Embedded Linux. Philip Tricca

TCG TPM2 Software Stack & Embedded Linux. Philip Tricca TCG TPM2 Software Stack & Embedded Linux Philip Tricca philip.b.tricca@intel.com Agenda Background Security basics Terms TPM basics What it is / what it does Why this matters / specific features TPM Software

More information

Cyber security for digital substations. IEC Europe Conference 2017

Cyber security for digital substations. IEC Europe Conference 2017 Cyber security for digital substations IEC 61850 Europe Conference 2017 Unrestricted Siemens 2017 siemens.com/gridsecurity Substation Digitalization process From security via simplicity 1st generation:

More information

Windows IoT Security. Jackie Chang Sr. Program Manager

Windows IoT Security. Jackie Chang Sr. Program Manager Windows IoT Security Jackie Chang Sr. Program Manager Rest Physical access to a device will not give access to data Data & Control Execution Data owner has full control over data processing Motion Transport

More information

Testpassport http://www.testpassport.net Exam : SY0-301 Title : Security+ Certification Exam 2011 version Version : Demo 1 / 5 1.Which of the following is the BEST approach to perform risk mitigation of

More information

Security in NVMe Enterprise SSDs

Security in NVMe Enterprise SSDs Security in NVMe Enterprise SSDs Radjendirane Codandaramane, Sr. Manager, Applications, Microsemi August 2017 1 Agenda SSD Lifecycle Security threats in SSD Security measures for SSD August 2017 2 SSD

More information

March 6, Dear Electric Industry Vendor Community: Re: Supply Chain Cyber Security Practices

March 6, Dear Electric Industry Vendor Community: Re: Supply Chain Cyber Security Practices March 6, 2019 Dear Electric Industry Vendor Community: Re: Supply Chain Cyber Security Practices On July 21, 2016, the Federal Energy Regulatory Commission (FERC) directed the North American Electric Reliability

More information

IC32E - Pre-Instructional Survey

IC32E - Pre-Instructional Survey Name: Date: 1. What is the primary function of a firewall? a. Block all internet traffic b. Detect network intrusions c. Filter network traffic d. Authenticate users 2. A system that monitors traffic into

More information

Accelerating the implementation of trusted computing

Accelerating the implementation of trusted computing Infineon Network Use Case Accelerating the implementation of trusted computing Building Confidence in Our Connected World with TPM middleware Products OPTIGA TPM www.infineon.com/ispn Use Case Use case

More information

PASS4TEST. IT Certification Guaranteed, The Easy Way! We offer free update service for one year

PASS4TEST. IT Certification Guaranteed, The Easy Way!  We offer free update service for one year PASS4TEST \ http://www.pass4test.com We offer free update service for one year Exam : SY0-301 Title : CompTIA Security+ Certification Exam (SY0-301) Vendor : CompTIA Version : DEMO 1 / 5 Get Latest & Valid

More information

Statement for the Record

Statement for the Record Statement for the Record of Seán P. McGurk Director, Control Systems Security Program National Cyber Security Division National Protection and Programs Directorate Department of Homeland Security Before

More information

econet smart grid gateways: econet SL and econet MSA FIPS Security Policy

econet smart grid gateways: econet SL and econet MSA FIPS Security Policy econet smart grid gateways: econet SL and econet MSA FIPS 140 2 Security Policy Level 2 Validation Document Version 0.5 Hardware Versions: ENSL2, ENSL5 and ENMSA2 Firmware Version: 3.2.1 FIPS Nexgrid,

More information

Towards Effective Cybersecurity for Modular, Open Architecture Satellite Systems

Towards Effective Cybersecurity for Modular, Open Architecture Satellite Systems SSC16-IV-6 Towards Effective Cybersecurity for Modular, Open Architecture Satellite Systems Presented to: 30 th Annual AIAA/USU Conference on Small Satellites August 2016 Presented by: Geancarlo Palavicini

More information

Securing Software Applications Using Dynamic Dataflow Analysis. OWASP June 16, The OWASP Foundation

Securing Software Applications Using Dynamic Dataflow Analysis. OWASP June 16, The OWASP Foundation Securing Software Applications Using Dynamic Dataflow Analysis Steve Cook OWASP June 16, 2010 0 Southwest Research Institute scook@swri.org (210) 522-6322 Copyright The OWASP Foundation Permission is granted

More information

ДОБРО ПОЖАЛОВАТЬ SIEMENS AG ENERGY MANAGEMENT

ДОБРО ПОЖАЛОВАТЬ SIEMENS AG ENERGY MANAGEMENT ДОБРО ПОЖАЛОВАТЬ SIEMENS AG ENERGY MANAGEMENT ENERGY AUTOMATION - SMART GRID Restricted Siemens AG 20XX All rights reserved. siemens.com/answers Frederic Buchi, Energy Management Division, Siemens AG Cyber

More information

Expert Reference Series of White Papers. BitLocker: Is It Really Secure? COURSES.

Expert Reference Series of White Papers. BitLocker: Is It Really Secure? COURSES. Expert Reference Series of White Papers BitLocker: Is It Really Secure? 1-800-COURSES www.globalknowledge.com BitLocker: Is It Really Secure? Mark Mizrahi, Global Knowledge Instructor, MCSE, MCT, CEH Introduction:

More information

ECCouncil Exam v9 Certified Ethical Hacker Exam V9 Version: 7.0 [ Total Questions: 125 ]

ECCouncil Exam v9 Certified Ethical Hacker Exam V9 Version: 7.0 [ Total Questions: 125 ] s@lm@n ECCouncil Exam 312-50v9 Certified Ethical Hacker Exam V9 Version: 7.0 [ Total Questions: 125 ] Question No : 1 An Intrusion Detection System(IDS) has alerted the network administrator to a possibly

More information

BLACK HAT USA 2013 ADD A CLASS REQUEST FORM INSTRUCTIONS

BLACK HAT USA 2013 ADD A CLASS REQUEST FORM INSTRUCTIONS Use one form per registrant. BLACK HAT USA 2013 ADD A CLASS REQUEST FORM INSTRUCTIONS This form is for those who have existing USA 2013 Training Registration and have an existing Confirmation Number. If

More information

IS THERE A HOLE IN YOUR RISC-V SECURITY STACK? JOTHY ROSENBERG DOVER MICROSYSTEMS

IS THERE A HOLE IN YOUR RISC-V SECURITY STACK? JOTHY ROSENBERG DOVER MICROSYSTEMS IS THERE A HOLE IN YOUR RISC-V SECURITY STACK? JOTHY ROSENBERG DOVER MICROSYSTEMS I understand the difference in destruction is dramatic, but this has a whiff of August 1945. Someone just used a new weapon,

More information

Cryptography Basics. IT443 Network Security Administration Slides courtesy of Bo Sheng

Cryptography Basics. IT443 Network Security Administration Slides courtesy of Bo Sheng Cryptography Basics IT443 Network Security Administration Slides courtesy of Bo Sheng 1 Outline Basic concepts in cryptography systems Secret key cryptography Public key cryptography Hash functions 2 Encryption/Decryption

More information

Engineering Your Software For Attack

Engineering Your Software For Attack Engineering Your Software For Attack Robert A. Martin Senior Principal Engineer Cyber Security Center Center for National Security The MITRE Corporation 2013 The MITRE Corporation. All rights reserved.

More information

Security: The Key to Affordable Unmanned Aircraft Systems

Security: The Key to Affordable Unmanned Aircraft Systems AN INTEL COMPANY Security: The Key to Affordable Unmanned Aircraft Systems By Alex Wilson, Director of Business Development, Aerospace and Defense WHEN IT MATTERS, IT RUNS ON WIND RIVER EXECUTIVE SUMMARY

More information

تاثیرفناوری اطالعات برسازمان ومدیریت جلسه هشتم و نهم

تاثیرفناوری اطالعات برسازمان ومدیریت جلسه هشتم و نهم بنام خدا تاثیرفناوری اطالعات برسازمان ومدیریت جلسه هشتم و نهم امنیت بخشی به سیستمهای فناوری اطالعات Securing Information Systems 1 Learning Objectives Describe the business value of security and control.

More information

.NET Secure Coding for Client-Server Applications 4-Day hands on Course. Course Syllabus

.NET Secure Coding for Client-Server Applications 4-Day hands on Course. Course Syllabus .NET Secure Coding for Client-Server Applications 4-Day hands on Course Course Syllabus Course description.net Secure Coding for Client-Server Applications 4-Day hands on Course Secure programming is the

More information

How to Create, Deploy, & Operate Secure IoT Applications

How to Create, Deploy, & Operate Secure IoT Applications How to Create, Deploy, & Operate Secure IoT Applications TELIT WHITEPAPER INTRODUCTION As IoT deployments accelerate, an area of growing concern is security. The likelihood of billions of additional connections

More information