lassedesignen - Fotolia
Continue Reading This Article
Enjoy this article as well as all of our content, including E-Guides, news, tips and more.
Trusted computing systems rely on multiple layers of security throughout the entire stack, which are described in the Orange Book, a common nickname for the "Trusted Computer System Evaluation Criteria" published by the U.S. Department of Defense. These systems have historically been expensive, not necessarily cutting-edge and are used only in government or high-security environments. Significant formal testing is required to ensure these systems' security.
Modern systems were built based on the experiences of developing these trusted computer systems, but outside of the trusted platform module, they do not share many of the same principles. Trusted systems were designed to disallow one process on a system from accessing the memory or hardware resources used by other processes as a method of resisting a side-channel attack.
This side-channel attack on the CPU cache and memory management unit can also be used against virtual machines and cloud providers.
ASLR has been the focus of many attacks, and new protections have been implemented to address this. The Vrije Universiteit Amsterdam researchers have been working with CPU manufacturers to come up with CPU updates that would make them more resistant to these types of attacks.
Unfortunately, the researchers also stated that ASLR is fundamentally insecure, and that any fixes to this side-channel attack cost too much in terms of performance and are, therefore, impractical.
Find out how the Stagefright exploit Metaphor can bypass ASLR on Android devices
Learn how a Linux vulnerability enables attacks on TCP communications
Discover how SSL session identities can be protected from the Ticketbleed flaw
Dig Deeper on Data security and privacy
Related Q&A from Nick Lewis
What are port scan attacks and how can they be prevented?
Port scans provide data on how networks operate. In the wrong hands, this info could be part of a larger malicious scheme. Learn how to detect and ... Continue Reading
Explore benefits and challenges of cloud penetration testing
Cloud penetration testing presents new challenges for information security teams. Here's how a playbook from the Cloud Security Alliance can help ... Continue Reading
What are the best criteria to use to evaluate cloud service providers?
Many cloud providers are tight-lipped about internal security control details. Learn how to evaluate cloud security providers with certifications and... Continue Reading