As the appetite for exploiting security flaws intensifies, so does the broad spectrum of vulnerabilities. It’s important to consider each type of vulnerability and how these could impact your system. At Arm we split the types of vulnerability into four areas: communication, physical, lifecycle and software.
Communication Vulnerabilities
Attackers can try multiple means to intercept, spoof or disrupt messages sent from devices back to the server. Best-practice cryptographic defences must match the increasing value data being communicated.
Physical Vulnerabilities
Silicon attacks are often split into two categories: non-invasive and invasive. Non-invasive (side-channel) use different ways to try to observe the chip to gain information. These include perturbation techniques–altering the power supply voltage or interfering with electromagnetic signatures. Invasive techniques involve opening the chip to probe or modify part of the passivation layer.
Lifecycle Vulnerabilities
Devices changes hands many times—from factory to user, to maintenance and to end-of-life. The integrity of the device must be protected at each step: who is repairing it, how is confidential data handled, are firmware upgrades legitimate. Unplanned or forbidden paths, such a theft, overages, or Wi-Fi changes are all vulnerabilities to consider.
Software Vulnerabilities
These are the most common attacks where someone finds a way of using existing cost to get access to restricted resources. It could be due to a software bug or to unexpected call sequences that are open to whole classes of exploits.
Key Security Goals
As a founder of PSA Certified, Arm believe that every connected device needs to meet 10 fundamental security goals. These goals help to overcome some of the most fundamental security threats, ensuring there is a baseline for security. Achieving these 10 security goals requires a number of things, including specific counter-measures.
Counter-Measures
Selecting the right security products for a device requires careful analysis to identify the level of threat while considering all four types of vulnerability. Ask yourself: what are the assets of my application? How sensitive are they? What are the risks to my business if they are exposed? What lengths will an attacker take to access the assets? PSA Certified advises to start security design with analysis and answering these important questions, using threat modelling (or a protection profile) to identify the appropriate counter-measures. Once this extensive analysis is complete and you have a list of security requirements, it’s time to select the best counter-measures for your application.
Arm offers a wide spectrum of security IP to mitigate the risks associated with each vulnerability. These include products that can help with cryptography, security services, isolation and tamper mitigation.