{"id":1963,"date":"2020-11-12T16:17:00","date_gmt":"2020-11-12T16:17:00","guid":{"rendered":"https:\/\/www.tantraanalyst.com\/insights\/?p=1963"},"modified":"2023-01-03T05:10:12","modified_gmt":"2023-01-03T05:10:12","slug":"ai-powered-hardware-based-preemptive-security-is-a-game-changer","status":"publish","type":"post","link":"https:\/\/www.tantraanalyst.com\/ta\/ai-powered-hardware-based-preemptive-security-is-a-game-changer\/","title":{"rendered":"Ai-powered, hardware-based preemptive security is a game changer"},"content":{"rendered":"
\"Ai-powered\"<\/a>
GSA News, November 12, 2020<\/span><\/figcaption><\/figure>\n
Cybercrime cost an estimated $6 Trillion[1]\u00a0a year to the global economy. Everybody claims security is their top priority. But sadly, during product design and implementation tradeoffs, performance and other considerations take the front seat and security often becomes an afterthought, and in most cases, after-the-fact. Even when implemented properly, today\u2019s security architecture is static and limited to individual components of the system, lacking a holistic, system-wide approach. scenario to be verified. This description includes the expected outcome, and this outcome is used as a basis on which to run the planning algorithm.<\/span><\/h6>\n
\"\"<\/span><\/h6>\n

Progressive increase of cybersecurity breaches over the years | Sources: www.databreaches.net, www.idtheftcenter.org and media reports.<\/span><\/p>\n

<\/h6>\n
In this article, we propose how AI-powered, hardware-based, and preemptive architecture is the best solution to achieving comprehensive, tamper resilient security. We also argue how such an architecture, by adapting to the changing landscape, can be a game changer.<\/span><\/h6>\n
Vicious \u201cidentify-patch-n<\/strong>ew exploit\u201d cycle<\/strong><\/span><\/h6>\n
Today\u2019s security has become an unending cycle of \u201cbreach identification\u2014patching\u2014intruders moving on to new vulnerabilities.\u201d\u00a0 We can only estimate the losses from the identified security breaches. However, the most dangerous attacks are the ones that are not discovered, and damages from them are probably magnitudes higher.<\/span><\/h6>\n
The only way to stop this vicious cycle is to move away from the after-the-fact remedies and adopt a preemptive approach, where the attacks are stopped in their tracks before the damage is done.<\/span><\/h6>\n
Also, the compromised components must be quickly isolated, threats neutralized, and if possible, recovered and brought back to service.\u00a0 Additionally, a static security regime is no match against highly sophisticated intruders and keeps the vicious cycle alive. The security architecture must continually learn, evolve, and stay ahead of the threats.<\/span><\/h6>\n
Current security landscape and challenges<\/span>
\n<\/strong><\/span><\/h6>\n
The complexity of the security challenge is extremely hard to fully comprehend and even more difficult to address. According to the analyst firm Gartner, global\u00a0security spend in 2019<\/span><\/a>[2]<\/sup>\u00a0topped $120 Billion.\u00a0 It is expected to grow very rapidly as almost every aspect of human life is being digitized and the digital transformation of the society is hitting high gear.<\/span><\/h6>\n
According to\u00a0some estimates<\/span><\/a>[3]<\/sup>, there are more than 140,000 security vulnerabilities identified in today\u2019s information systems. These vulnerabilities can be found in servers, terminal devices, hardware, firmware and application software, and everything in between. Moreover, within each node, there are vulnerabilities at every layer of hardware and software stack.<\/span><\/h6>\n
For example, the well-publicized \u201cSpectre<\/a><\/span>\u201d[4]<\/sup>\u00a0attack was a classic case of intruders exploiting vulnerability around processors utilizing its internal memory called a cache. Hundreds of vulnerabilities are discovered and patched in the firmware, operating systems, and applications every year. The constant security updates our devices and networks receive is a clear indication of this reality.<\/span><\/h6>\n
Security threats can be largely divided into three categories: The biggest one is (1) credentials\u2014being stolen by malware or keyloggers, followed by (2) device ID\u2014tampered with or cloned, and lastly (3) ports\u2014unauthorized opening allowing malware to enter the system. The weakest link in security is humans. No matter how much systematic improvement you bring, any security that does not address irrational human behavior is doomed to fail.<\/span><\/h6>\n
Industry response to all these threats, so far, has been applying band-aid solutions, largely implemented in software in the form of patches. As evident, this has not been highly effective. Fortunately, the tech industry is realizing that root-of-trust must be based on hardware and not relegated to software. There have already been some commendable efforts, such as Arm\u2019s Trust Zone, and Intel\u2019s or AMD\u2019s secure boot, and establishing chip or device ID as the root-of-trust, etc.<\/span><\/h6>\n
But\u00a0recent instances<\/span><\/a>[5,6]<\/sup>\u00a0have illustrated that this alone is not enough. There has to be an architecture that takes a holistic view of the full system instead of having each component managing its own security in a node, be it a single host processor in a simple IoT device or multiple different kinds of host processors in today\u2019s servers.<\/span><\/h6>\n
Security addressed at every layer<\/span>
\n<\/strong><\/span><\/h6>\n
It is very clear that an ideal architecture should address security at every layer of the stack, both in hardware, and software domains.<\/span><\/h6>\n
\"\"<\/span><\/h6>\n

Security must be addressed at every layer of the stack.<\/span><\/p>\n

A security architecture should support hardware root-of-trust, based on a chip\u2019s or device\u2019s immutable hardware ID. This architecture is a necessary prerequisite for a Trusted Execution Environment (TEE), a mix of hardware and software features used to enable an environment in which the OS and applications and users can trust that the execution of software is as intended and not compromised. It will also have to rely on securely storing data, including the firmware, encryption keys, sensitive user, and application data, as well as space for running secure applications. Furthermore, the architecture should support secure boot with signed firmware. All sensitive functions, such as operating system and key user applications should run in the TEE. Many of these functions might run on same processors side-by-side with other non-secure applications. However, there should be a clear, logical separation between the two; the interaction between secure and non-secure applications, as well as access to secure data, should only happen through secure APIs.<\/span><\/h6>\n
These are the basic needs of any system, especially when they are deployed in public places such as hospitals or outdoors, where physical security is not feasible. Further, depending on the application, there might be even more fortification needed. For example, servers for highly sensitive use cases such as military installations might have their own specialized OS, compilers, and applications, so that intruders do not have any access to them at all.<\/span><\/h6>\n
Dedicated hardware for holistic, system-wide security<\/strong><\/span><\/h6>\n
Looking at any computer system, be it servers or personal computers, you will usually find multiple processors with varying levels of processing power, on-board memory, and other capabilities, and of course, cost. That means some of these systems might have a full suite of security features we discussed in the previous section, and some others, only a subset. It is nearly impossible to have a uniform security profile across a system that is only as secure as its weakest link. As it happens with most breaches, intruders attack the parts with weak security to break-in.<\/span><\/h6>\n
Another classic case: even processors with top-notch security might still have some minor vulnerabilities that on their own might be harmless, but when integrated into a system, might create a much bigger security hole. Again, another hacker favorite!<\/span><\/h6>\n
In many cases where individual, component-level security is grossly inadequate to protect the full system, the only plausible approach to solving the problem is to have a holistic architecture. We propose that the best way to achieving this goal is to outsource security to a purpose-built, hardened, dedicated, onboard security processor that monitors all components of a system round the clock, and identifies and blocks all attacks, be it against weak components or system exploits.<\/span><\/h6>\n
This security processor, hardened to the brim, could be a central secure storage for the whole system, and can hold firmware images and other data that we discussed in the previous section. So, even if one of the host processors is compromised, it can always get a correct copy of the firmware image, keys, and other data from the security processor.<\/span><\/h6>\n
A security processor can also limit the spread of intrusion to other parts of the system. Once detected, this processor could simply isolate the infected parts, or in the worst-case scenario, fully shut down the system to avoid any further damage.<\/span><\/h6>\n
Even with hardening, this security processor may be attacked as well. However, being a sperate component, it can be better equipped to recover itself or other processors after the intrusion. Above all, there is another major reason\u2014running security AI, which we will go into more detail in the next section.<\/span><\/h6>\n
In essence, an architecture where a dedicated security processor could be the first and the last line of defense between an intruder and the whole system, always monitoring, protecting, and even recovering compromised components. Considering all this, such dedicated hardware, albeit with the additional cost, is well worth it.<\/span><\/h6>\n
AI for preemptive security<\/strong><\/span><\/h6>\n
A major issue with today\u2019s security regime is an after-the-fact approach. Patching vulnerabilities is akin to closing doors after everything is looted from a home. An even bigger challenge is the intrusions that are not even detected. In high-value hacks, such as industrial or military espionage, hackers usually attack with pinpoint accuracy, and leave without any tracks or trace. This means that those attacks and damages are not discovered, and intruders can continue utilizing those vulnerabilities, almost at free will.<\/span><\/h6>\n
The best security approach is to preemptively stop attacks even before they start or when they are in their tracks, so that the damage can be minimized if not fully avoided. AI can be extremely helpful in achieving that.<\/span><\/h6>\n
To illustrate this, a simple example is if data transfer from a device identifying itself as a keyboard is much faster than a human can type, it is easy to determine that the device is suspicious, and can be isolated. This type of behavioral analysis detecting threats can be exceedingly complex. Remember we mentioned, humans are the weakest links in security? A good AI is a great antidote to analyzing user behavior and quickly spotting anomalies.<\/span><\/h6>\n
\"\"<\/span><\/h6>\n

A learning and adapting AI can make system security preemptive.<\/span><\/p>\n

An AI-based security architecture can continuously learn, monitor, and perform security assessments based on user, device, and session profiles. It can detect runtime anomalies, and either send alerts or take automated action based on the policy set by the user.<\/span><\/h6>\n
The security and risk landscape keeps continually changing. In many cases, it evolves in parallel or even faster than the security improvements themselves. Considering that many systems, such as servers or industrial IoT devices typically have ten or more years of life span, a static security regime is not sustainable. AI makes security systems agile and always updated on the latest threats, not only from its own learning but also from models trained elsewhere on large datasets.<\/span><\/h6>\n
AI is another reason why dedicated security hardware, i.e., a security processor, is extremely important. For an AI to be effective, it must monitor the behavior and functions of the entire system, which may not be possible if it is running on the host processor. In cases where the host processor running its own AI algorithms is hacked, the AI effort is futile. Hence, it makes sense to run them on a hardened, dedicated security processor.<\/span><\/h6>\n
In closing<\/strong><\/span><\/h6>\n
Cybersecurity is one of the major challenges faced by the global tech industry. The global economy incurs huge losses because of compromised security and spends large amounts of money and resources to protect against attacks. Additionally, unidentified attacks probably cost magnitudes more than the known ones. With the digital transformation of the global economy at full speed, security challenges will be getting even harder and the costs even steeper.<\/span><\/h6>\n
The current after-the-fact approach to security has resulted in an unending vicious cycle of \u201cidentify-patch-new exploit.\u201d To break this cycle, the industry should adopt a holistic, preemptive security architecture that consists of security at every layer of the stack, and an onboard dedicated, hardened security processor running AI. Such an architecture can learn and monitor the entire system, quickly identify suspicious behavior, disarm intruders from utilizing vulnerabilities, and stop attacks even before they begin or cause any damage. Finally, it can continuously adapt to the constantly changing security risk landscape. Such an architecture will no doubt be a game changer for the security industry.<\/span><\/h6>\n
Meanwhile, If you want to read more articles like this and get an up-to-date analysis of the latest mobile and tech industry news, sign-up for our monthly newsletter at\u00a0TantraAnalyst.com\/Newsletter<\/a><\/span>, or listen to our\u00a0Tantra\u2019s Mantra podcast<\/span><\/a>.<\/span><\/h6>\n","protected":false},"excerpt":{"rendered":"

Cybercrime cost an estimated $6 Trillion[1]\u00a0a year to the global economy. Everybody claims security is their top priority. But sadly, during product design and implementation tradeoffs, performance and other considerations take the front seat and security often becomes an afterthought, and in most cases, after-the-fact. Even when implemented properly, today\u2019s security architecture is static and […]<\/p>\n","protected":false},"author":2,"featured_media":1964,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"image","meta":{"mc4wp_mailchimp_campaign":[],"footnotes":""},"categories":[58],"tags":[],"class_list":["post-1963","post","type-post","status-publish","format-image","has-post-thumbnail","hentry","category-ai-compute-iot","post_format-post-format-image"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.tantraanalyst.com\/ta\/wp-json\/wp\/v2\/posts\/1963","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.tantraanalyst.com\/ta\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.tantraanalyst.com\/ta\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.tantraanalyst.com\/ta\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.tantraanalyst.com\/ta\/wp-json\/wp\/v2\/comments?post=1963"}],"version-history":[{"count":0,"href":"https:\/\/www.tantraanalyst.com\/ta\/wp-json\/wp\/v2\/posts\/1963\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.tantraanalyst.com\/ta\/wp-json\/wp\/v2\/media\/1964"}],"wp:attachment":[{"href":"https:\/\/www.tantraanalyst.com\/ta\/wp-json\/wp\/v2\/media?parent=1963"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.tantraanalyst.com\/ta\/wp-json\/wp\/v2\/categories?post=1963"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.tantraanalyst.com\/ta\/wp-json\/wp\/v2\/tags?post=1963"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}