Wave Systems Corp. (fka WAVXQ)

[jakes_dad]

Nice find Awk

from your newsletter:

7.
Utilize endpoint security and TPM for higher assurance machine identity authentication and machine health checks

The heart of trusted computing consists of a Trusted Platform Module (TPM), a highly secure chip on the motherboard of personal computers (PCs), which can create and securely store a unique identification number for each device. Trusted computing can be further enhanced when a self-encrypting drive (SED) is added to the PC. Over the past few years, over 400 million Trusted Platform Modules have been shipped inside virtually every business class PC. Today over 90 percent of all platforms include the current version of the TPM specification (TPM 1.2). TPMs are based on an open, international industry standard shared by leading manufacturers through an industry association, the Trusted Computing Group. TPMs are manufactured by a number of leading chip companies including AMD, Broadcom, Infineon, and Intel. All the leading PC manufacturers incorporate TPMs in business class machines including Dell, HP, Toshiba, Acer, Lenovo, Samsung, Sony, Gateway, and Panasonic. TPMs are required by Microsoft Vista and Windows 7 business versions for those customers using BitLocker.
Security of VPNs, email, and many other services that rely on certificates or keys to protect networks or data are greatly enhanced when these items are stored in tamper-resistant hardware (e.g., TPM) rather than in software (e.g., Windows registry). These keys and certificates are non-spoofable and cannot be copied. Recently, the U.S. National Security Agency (NSA) demonstrated at their trusted computing conference that VPN certificates stored in the Windows registry can easily be hacked using readily available software from the Internet. The NSA is now publicly recommending using TPMs to store certificates (http://www.nsa.gov/ia/_files/host_networking_brochure.pdf). When TPM-secured VPN credentials are used with self-encrypting drives, then no additional password is necessary because the device is proved to be managed and an authorized user has been authenticated.
TPMs provide an endpoint root of trust that allows companies to authorize and then only allow known computers on their network. This means only authorized, company-owned or partner company computers are allowed access to the network.
TPMs provide a unique advantage over other authentication methodologies since they are already deployed on most business class PCs. This represents a substantial cost savings over other technologies like unique key tokens and smart cards, which can cost over $200 per user to deploy. TPMs using third-party management software, such as Wave Systems, also support user authentication such as password and biometrics to access the TPM. Common Access Cards (CAC)/Personal Identity Verification (PIV) cards
are also supported for single sign-on in situations where additional authentication is required.
TPMs also support machine health. Of growing concern today are PCs with low-level malware that can quickly infect an entire network. A lesser known capability of TPMs is monitoring many key parameters during machine boot-up. Platform Configuration Registers (PCR) store values or hashes of important parameters and files in the TPM during PC boot-up. If the same components are measured at a later time, and the measurements have changed, then the components have changed. Types of information that are monitored include the BIOS, boot loader, and other low-level system components. This mechanism can be used to detect whether system software has been infected with malware.
Network Access Control (NAC) systems enforce the health of a network’s endpoints and therefore help to establish trustworthy and secure network connections. In a NAC-enabled network, the health and configuration of a connecting computer system is checked before the network access is allowed. A computer system will be allowed to access the network and the associated services only if the security policies, as defined by the network administrator, are satisfied. Computer systems with a faulty or undesirable system configuration are deemed untrustworthy, are prevented from accessing the network to cause damage, and are usually sent to a remediation server to be brought under compliance.
Several products and architectures focus on NAC, including Microsoft’s Network Access Protection (NAP), Cisco NAC, and the Trusted Computing Group’s Trusted Network Connect (TNC).
The TNC standard defines an open architecture for interoperable network access control (NAC) solutions. The TNC architecture allows network administrators to enforce policies regarding endpoint integrity at or after network connection. The TNC architecture also includes the provision for using a Trusted Platform Module (TPM) as part of the solution for ensuring client integrity. The main purpose of using the TPM with a NAC solution is to mitigate attacks that are based on the “lying endpoint” problem. The “lying endpoint” problem is one of the main limitations of all of the current NAC solutions. The “lying endpoint” problem is caused when a client system is compromised by malware and that malware falsifies the collected and reported data to the NAC system. In other words, the client reports itself to the NAC system as being healthy when in fact it is not. TPM management software based on the TNC specification can work with the NAC system to verify the integrity of the client system, its startup state, and can also
ensure that the installed NAC client components have not been compromised by malware.
In addition, many modern microprocessors support a measured launch capability that can be leveraged to ensure the integrity of a post-boot software environment—such as an operating system kernel or virtual machine hypervisor. The measured launch may be used in conjunction with pre-boot measurements to provide reasonable assurance that critical system components have not been modified since the last launch.
TPMs working in concert with self-encrypting drives (SED) can execute self-healing or prevent a machine with suspected boot-up issues from starting or logging on to the network. TPMs working with SEDs can create a trusted environment supporting multiple virtual machines on a single PC.

For more information on TPM from Trusted Computing Group, see http://www.trustedcomputinggroup.org/developers/infrastructure/faq

Document authored by:

Wayne Boline, Raytheon
Jeffrey Nicholson, The Boeing Company
Andrew Tarbox, Wave Systems Corp.
John Tolbert, The Boeing Company
Jody Wahlgren, The Boeing Company
Martin Wargon, Wave Systems Corp.
Stephen Whitlock, The Boeing Company

http://www.tscp.org/images/stories/library/APT%20Best%20Practices%20Paper-1%2087%20final%2011-15-2010.pdf