Cyber Security Robustness of an Embedded Computing System with Trusted Computing Measures Built-in
Published in Military & Aerospace Electronics
Authored by Richard Jaenicke of Green Hills Software and Steve Edwards of Curtiss-Wright.
Systems designers who are considering creating a trusted computing platform able to host cross-domains solutions (CDS) and other multi-level security (MLS) applications have some decisions to make about software and hardware concerns. First, the designer needs to understand the levels of security functionality and assurance that a robust trusted-computing solution needs.
The international standard for security evaluation of an information technology (IT) product or technology is the Common Criteria for Information Technology Security Evaluation (ISO/IEC 15408) -- simply referred to as the Common Criteria (CC).
The Common Criteria provides common requirements for computer security and for assurance measures applied to those IT products during a security evaluation. Evaluations can be done to different levels of depth and rigor, called Evaluation Assurance Levels (EAL). Each EAL defines security-assurance requirements: EAL 1 is the least rigorous and EAL 7 is the most rigorous.
By definition, an EAL addresses only assurance requirements and not functional requirements of a security solution. This can lead to applying rigorous evaluation methods to very lax security functionality. The Common Criteria explicitly acknowledges this up front:
“The CC is intentionally flexible, enabling a range of evaluation methods for a range of security in IT products. Therefore users of the standard are cautioned to exercise care that this flexibility is not misused. For example, using the CC in conjunction with unsuitable evaluation methods, irrelevant security properties, or inappropriate IT products, may result in meaningless evaluation results.”
COTS-Based Trusted Computing: Getting Started in Next-Generation Mission-Critical Electronics
Trusted computing involves technologies protect mission-critical embedded electronics from physical and remote attacks and from hardware and software failures.
Establishing a Root of Trust: Trusted Computing and Intel-based Systems
Steve Edwards looks at trusted computing solutions that carry effective protections against cyberattacks.
Trusted Computing for Defense & Aerospace Article eBook
This collection of articles, originally published by Military & Aerospace Electronics, covers a variety of Trusted Computing topics such as trusted boot, cyber security, quantum computing, cryptography and more, with a specific focus on the defense and aerospace industries.
Director and Technical Fellow
Steve has over 25 years of experience in the embedded system industry. He leads Curtiss-Wright Defense Solutions’ efforts in addressing physical and cyber security on their COTS products and represents the company in defense related security conferences. Steve has worked collaboratively in several standard bodies, including a time chairing the VITA 65 OpenVPX, and as lead for the Sensor Open Systems Architecture (SOSA) Security Subcommittee. Steve lead the design of Curtiss-Wright’s first rugged multiprocessor and FPGA products and was involved in the architecture, management, and evangelization of the industry’s first VPX products. He has a Bachelor of Science in Electrical Engineering from Rutgers University.
Comprehensive protection throughout the product lifecycle
Curtiss-Wright goes well beyond standard approaches to Trusted Computing to provide truly secure solutions for air, ground, and sea platforms. We keep cybersecurity and physical protection in mind, from design and testing to supply chain and manufacturing. This comprehensive, end-to-end approach creates an effective mesh of protection layers that integrate to ensure reliability of Curtiss-Wright products in the face of attempted compromise.
Related White Papers
Cybersecurity Trends in Aerospace and Defense Applications
A recent online cybersecurity expert discussion explored emerging cybersecurity vulnerabilities and the challenges faced by the defense and aerospace industries in identifying and mitigating attacks. This white paper from Wind River summarizes the ideas and key points that were covered during this discussion.
Trends in Network Cybersecurity
We explore the ever-evolving domain of network security, a key segment of embedded systems that’s been under the microscope as cyber threats become more common.
Optimizing Cybersecurity on Today's Connected Military and Commercial Aircraft
System developers must safeguard tactical information exchange and the integrity of command and control links between ground stations and airborne platforms.