Wave Systems Corp. (fka WAVXQ)

[Snackman]

Here is the link open. Note bolds which are mine.

http://www.military-information-technology.com/article.cfm?DocID=1593

Trust the Computer

An industry group is developing open security standards aimed at resolving ongoing, multi-faceted threats to Department of Defense and other computers and networks by providing dedicated hardware-based solutions that also offer considerable savings on development time and cost.

The Trusted Computing Group (TCG) was formed in 2003 to develop open standards for hardware-enabled, platform-neutral, security technologies that work across multiple devices and peripherals. The idea behind the group, which now counts 141 industry members, is to work together to develop specifications for different facets of trusted computing that address a myriad of computer and network security problems transparently while minimizing the obstruction of open access.

The chief objective of the TCG was to produce a dedicated chip on the motherboard called the Trusted Platform Module (TPM) based on TCG-developed specifications. The goal of the TPM is to improve protection of data and the security in the login, e-mail and Web access process.

Once the TPM was built, chipmakers seized it, since the technology both improved security and represented savings on individual development time and cost. They then pumped out a succession of TPM implementations in their chipsets. Intel’s is called LaGrande Technology; AMD’s is the Secure Execution Mode; Hewlett Packard’s is ProtectTools; and IBM has the Embedded Security Subsystem and ThinkVantage Technology. National Semiconductor, Phoenix and Fujitsu also have implementations.

Microsoft’s next operating system, Windows Vista, will ship with technologies that take advantage of the TPM chip, including BitLocker Drive Encryption and a Microsoft cryptography application programming interface.

The TCG then released its Trusted Network Connect (TNC) protocol specification, based on a computer security protocol called Authentication, Authorization and Accounting (AAA). However, the TNC has richer functionality than AAA, adding network authorization based on hardware configuration and numerous other factors.

All of these developments proved decisive for the Army, which decided this spring to require TPM in its Army Small Computer Program solicitation. In fact, to react swiftly to the TCG’s industry-based security improvements, the Army instituted the requirement ahead of any announcement and many months prior to the expected 2007 release of Microsoft’s new Vista operating system. This way, newly bought computers with TPM will be ready and able to take advantage of the Vista security enhancements as soon as the operating system hits the market.

“With TPM, we are starting with a trusted baseline and building on that. That’s the difference between trusted computing and computer security. The latter is, in some cases, after the fact, putting in products to react without a trusted base,” said Ed Velez, chief technology officer for the Army Program Executive Office Enterprise Information Systems.

Multi-Vendor Solution

Participants say the use of the open standards process of developing specifications ensures that the best minds and technology in the industry are contributing to specifications that solve the most difficult computer and network security problems ever faced. “Once the specifications are approved by the TCG membership, then they are made public on the Web site for anybody, including nonmembers, to use. This gives the specs broader scrutiny in the process of evaluation,” said Brian Berger, chairman of TCG’s Marketing Working Group and a vice president at Wave Systems, a TCG founding member.

“The premise of the TCG is a hardware root of trust to protect secrets. This is a big change from the past, when security was based on software,” Berger noted.

In addition, the large membership of the TCG keeps healthy competition alive. “The TCG architecture has got the backing of a lot of companies, so we are not locking ourselves into any proprietary technology,” Velez said. “As we look at how the taxpayer gets the most bang for the buck, we see an opportunity to compete for the best technology with TCG because it’s a multi-vendor solution.”

When Dell and Gateway began shipping computers in April with Trusted Platform Modules, their systems came bundled with Wave Systems’ TPM-enabling security software, called Embassy Trust Suite, which consists of six modules. A client version of it is bundled with Dell Latitude laptops, for example, and a server version allows the enterprise or government agency to manage PCs with TPMs in their networks. Enhanced client and server versions of the software provide scalability.

Wave’s Embassy Trust Suite offers a list of features, including document protection, digital signatures, password management, key management and TPM management.

“We built the software for the new TCG standards, and with this, we now have the beginning of a common security structure with strong authentication and data protection on every machine,” said Steven Sprague, chief executive officer and president of Wave Systems.

Sprague emphasized the huge technology development savings inherent in the standards-based TCG multi-vendor security solution. “The industry has invested hundreds of millions of dollars in the course of building an interoperable security standard that every federal, municipal or state group or first responder or citizen will ultimately have. This is not something the government can do. It is something the industry can do, and the industry standards will make it happen,” he said.

Key defense contractors have also accepted standards-based TCG technology as a useful long-term solution to meet DoD requirements. “The TPM is effectively a tool that the computer uses to take a trusted measurement. When the computer boots up, it can take a measurement of the software integrity it’s loading into its memory,” noted Bill Ross, director of high assurance systems for General Dynamics C4 Systems.

But in order to complete the process, the Trusted Network Connect protocol must be used with the TPM to take the measurement and report it back to a central infrastructure. “As a result of the use of TPM with TNC, systems and network administrators can then create limited network access, which puts a suspected system into a quarantined network until a security problem is resolved,” said Ross.

However, access control extends beyond the network into hard drives and other peripherals and devices. Concern about the lack of hard drive data protection arose in May, for example, when the Department of Veteran’s Affairs reported the theft of a department data analyst’s laptop containing the private information of 26.5 million veterans.

Network Access

In a world with increasingly diverse networks with heterogeneous software and devices, network access is the biggest concern. By using TNC, network administrators can enforce security policies.

The TNC refers to a subgroup of the TCG and also to the set of nonproprietary specifications for open standards that address the network access and policy control portion of trusted computing. As one of the companies involved in developing TNC specifications for TCG’s interoperable security technologies, Juniper Networks announced in May that its own Unified Access Control product supports the TNC open standard.

Network access traditionally has been based on the user’s identity, but just because the user is authorized, that doesn’t mean the user’s machine is clean. “If a computer has been turned off for a week or two, it’s vulnerable once it’s turned on again because it doesn’t have the latest operating system and security patches,” pointed out Steve Hanna, Juniper Networks distinguished engineer and co-chair of the Trusted Network Connect subgroup of the TCG.

Hanna provided another real example of seemingly innocent computer use that is actually a threat to the system. “A lot of times people will turn off their anti-virus software and their firewall and then they are vulnerable. You need to turn them back on before you connect to the network,” he said. “If you get a brand new computer and bring it onto the network, the first things it will do is try to download the latest patches from Microsoft. But it gets infected before it has a chance to download those patches.”

The TNC architecture includes the endpoint Access Requester (AR), a Policy Enforcement Point (PEP), which functions like guards at the network that only let in machines that comply with network security policy and a Policy Decision Point (PDP). “The PDP is the brains of the operation, which evaluates each AR and makes complicated decisions to determine which machines should get in or not. It can be based on hardware or software, but it is moving increasingly into the hardware appliance mode,” said Hanna.

The TNC also includes a series of plug-in application programming interfaces, which hook the whole system into TPM. And TCG members have contributed various types of technology to the TNC ecosystem. For instance, IBM, Symantec and Wave have all provided Integrity Measurement Collectors as part of the TNC.

Symantec’s anti-virus software has an add-on that works as part of the TNC system. IBM’s Tivoli has a Security Compliance Manager that acts as an early warning system by identifying security vulnerabilities and security policy violations. And Wave System’s Embassy Endpoint Enforcer, which works with Juniper Networks, Meetinghouse and Nortel products, serves to link the TPM to the TNC system.

One of the biggest threats is criminally organized malware that produces a stealthy infection called Rootkit. “It hides from anti-virus software, burrows its way into your operating system at a low level where it can’t be found and gives false reports to anti-virus software,” explained Hanna. “The only way to detect Rootkit is with hardware.”

Rootkit is but one example of why a growing number of enterprises are moving toward the use of hardware-based TPM. “You can’t change the TPM. If it’s turned on and used to measure everything that loads when the machine boots up, it will then report it back to the server, which then will check for a valid configuration. If the configuration is invalid, the PDP will send remediation instructions to your machine through the client server interface and finally, the PEP will quarantine the suspected machine,” he said.

Given the requirement to have the strongest possible network security, DoD is looking not only at TPM but also at using the TNC as a way to provide that, Hanna noted.

The TCG is also working steadily to continue expanding its security technology health checks. “Someday, we will have TNC health checks with cell phones,” Hanna predicted. “Even if you don’t download games or ringtones, a lot of mobile phones have Web browsers and Instant Messaging, and they could get infected that way. The bottom line is that anything that connects to the network should be included in a health check.”