"Patching" is a leadership and management style, also. I have seen numerous leaders who eschew the more expensive (all at once) solutions that would strike at the root of the problem(s), and eliminate for good any vulnerabilities. They opt, instead, for patches/band-aids, that fix the immediate problem without striking at the root cause.
This can happen in any portion of business activities. I have watched my own workplace be hacked numerous times, but the only response is to try to track down the hacker, and not to improve security.
I say this because of the comments from the Princeton researchers, who pointed not to software encryption, but to the TCG solutions as a whole. They said "Trusted Computing" was vulnerable, not just software encryption. This misinformation may be enough to cause hesitation and further "patching" approaches among senior IT professionals. It also reinforces a dogmatic belief of theirs that nothing is unhackable.
I wonder if the Princeton researchers are among those who hate the DRM movement and identify Trusted Computing as a possible facilitating system for DRM. Perhaps that is why they chose to speak as they did. Politically, that might be a point for Wave to make if they are questioned about the study while on sales calls with customers.
I am glad to see Steven on the offensive immediately. That's exactly what is needed right now. I think that this may indeed be a penultimate moment for Wave. It is gratifying to see SKS quoted immediately- it seems that the reporters knew that Wave was the center of expertise for hardware based Trusted Computing. Perhaps Seagate and Wave will produce a demonstration of sorts of the security of TPMs against this type of attack. Or, invite the Princeton researchers to try to hack the Seagate/Wave solution. That would put us at the the forefront of this issue, and provide many multiples of return on our investment in a bit of advertising and demonstrating right now. The free publicity would be tremendous.
So, go get 'em, Steven (and Seagate)
AI
