12
Nov
Ai-powered, hardware-based preemptive security is a game changer
Cybercrime cost an estimated $6 Trillion[1] a year to the global economy. Everybody claims security is their top priority. But sadly, during product design and implementation tradeoffs, performance and other considerations take the front seat and security often becomes an afterthought, and in most cases, after-the-fact. Even when implemented properly, today’s security architecture is static and limited to individual components of the system, lacking a holistic, system-wide approach. scenario to be verified. This description includes the expected outcome, and this outcome is used as a basis on which to run the planning algorithm.
Progressive increase of cybersecurity breaches over the years | Sources: www.databreaches.net, www.idtheftcenter.org and media reports.
In this article, we propose how AI-powered, hardware-based, and preemptive architecture is the best solution to achieving comprehensive, tamper resilient security. We also argue how such an architecture, by adapting to the changing landscape, can be a game changer.
Vicious “identify-patch-new exploit” cycle
Today’s security has become an unending cycle of “breach identification—patching—intruders moving on to new vulnerabilities.” We can only estimate the losses from the identified security breaches. However, the most dangerous attacks are the ones that are not discovered, and damages from them are probably magnitudes higher.
The only way to stop this vicious cycle is to move away from the after-the-fact remedies and adopt a preemptive approach, where the attacks are stopped in their tracks before the damage is done.
Also, the compromised components must be quickly isolated, threats neutralized, and if possible, recovered and brought back to service. Additionally, a static security regime is no match against highly sophisticated intruders and keeps the vicious cycle alive. The security architecture must continually learn, evolve, and stay ahead of the threats.
Current security landscape and challenges
The complexity of the security challenge is extremely hard to fully comprehend and even more difficult to address. According to the analyst firm Gartner, global security spend in 2019[2] topped $120 Billion. It is expected to grow very rapidly as almost every aspect of human life is being digitized and the digital transformation of the society is hitting high gear.
According to some estimates[3], there are more than 140,000 security vulnerabilities identified in today’s information systems. These vulnerabilities can be found in servers, terminal devices, hardware, firmware and application software, and everything in between. Moreover, within each node, there are vulnerabilities at every layer of hardware and software stack.
For example, the well-publicized “Spectre”[4] attack was a classic case of intruders exploiting vulnerability around processors utilizing its internal memory called a cache. Hundreds of vulnerabilities are discovered and patched in the firmware, operating systems, and applications every year. The constant security updates our devices and networks receive is a clear indication of this reality.
Security threats can be largely divided into three categories: The biggest one is (1) credentials—being stolen by malware or keyloggers, followed by (2) device ID—tampered with or cloned, and lastly (3) ports—unauthorized opening allowing malware to enter the system. The weakest link in security is humans. No matter how much systematic improvement you bring, any security that does not address irrational human behavior is doomed to fail.
Industry response to all these threats, so far, has been applying band-aid solutions, largely implemented in software in the form of patches. As evident, this has not been highly effective. Fortunately, the tech industry is realizing that root-of-trust must be based on hardware and not relegated to software. There have already been some commendable efforts, such as Arm’s Trust Zone, and Intel’s or AMD’s secure boot, and establishing chip or device ID as the root-of-trust, etc.
But recent instances[5,6] have illustrated that this alone is not enough. There has to be an architecture that takes a holistic view of the full system instead of having each component managing its own security in a node, be it a single host processor in a simple IoT device or multiple different kinds of host processors in today’s servers.
Security addressed at every layer
It is very clear that an ideal architecture should address security at every layer of the stack, both in hardware, and software domains.
Security must be addressed at every layer of the stack.
A security architecture should support hardware root-of-trust, based on a chip’s or device’s immutable hardware ID. This architecture is a necessary prerequisite for a Trusted Execution Environment (TEE), a mix of hardware and software features used to enable an environment in which the OS and applications and users can trust that the execution of software is as intended and not compromised. It will also have to rely on securely storing data, including the firmware, encryption keys, sensitive user, and application data, as well as space for running secure applications. Furthermore, the architecture should support secure boot with signed firmware. All sensitive functions, such as operating system and key user applications should run in the TEE. Many of these functions might run on same processors side-by-side with other non-secure applications. However, there should be a clear, logical separation between the two; the interaction between secure and non-secure applications, as well as access to secure data, should only happen through secure APIs.
These are the basic needs of any system, especially when they are deployed in public places such as hospitals or outdoors, where physical security is not feasible. Further, depending on the application, there might be even more fortification needed. For example, servers for highly sensitive use cases such as military installations might have their own specialized OS, compilers, and applications, so that intruders do not have any access to them at all.
Dedicated hardware for holistic, system-wide security
Looking at any computer system, be it servers or personal computers, you will usually find multiple processors with varying levels of processing power, on-board memory, and other capabilities, and of course, cost. That means some of these systems might have a full suite of security features we discussed in the previous section, and some others, only a subset. It is nearly impossible to have a uniform security profile across a system that is only as secure as its weakest link. As it happens with most breaches, intruders attack the parts with weak security to break-in.
Another classic case: even processors with top-notch security might still have some minor vulnerabilities that on their own might be harmless, but when integrated into a system, might create a much bigger security hole. Again, another hacker favorite!
In many cases where individual, component-level security is grossly inadequate to protect the full system, the only plausible approach to solving the problem is to have a holistic architecture. We propose that the best way to achieving this goal is to outsource security to a purpose-built, hardened, dedicated, onboard security processor that monitors all components of a system round the clock, and identifies and blocks all attacks, be it against weak components or system exploits.
This security processor, hardened to the brim, could be a central secure storage for the whole system, and can hold firmware images and other data that we discussed in the previous section. So, even if one of the host processors is compromised, it can always get a correct copy of the firmware image, keys, and other data from the security processor.
A security processor can also limit the spread of intrusion to other parts of the system. Once detected, this processor could simply isolate the infected parts, or in the worst-case scenario, fully shut down the system to avoid any further damage.
Even with hardening, this security processor may be attacked as well. However, being a sperate component, it can be better equipped to recover itself or other processors after the intrusion. Above all, there is another major reason—running security AI, which we will go into more detail in the next section.
In essence, an architecture where a dedicated security processor could be the first and the last line of defense between an intruder and the whole system, always monitoring, protecting, and even recovering compromised components. Considering all this, such dedicated hardware, albeit with the additional cost, is well worth it.
AI for preemptive security
A major issue with today’s security regime is an after-the-fact approach. Patching vulnerabilities is akin to closing doors after everything is looted from a home. An even bigger challenge is the intrusions that are not even detected. In high-value hacks, such as industrial or military espionage, hackers usually attack with pinpoint accuracy, and leave without any tracks or trace. This means that those attacks and damages are not discovered, and intruders can continue utilizing those vulnerabilities, almost at free will.
The best security approach is to preemptively stop attacks even before they start or when they are in their tracks, so that the damage can be minimized if not fully avoided. AI can be extremely helpful in achieving that.
To illustrate this, a simple example is if data transfer from a device identifying itself as a keyboard is much faster than a human can type, it is easy to determine that the device is suspicious, and can be isolated. This type of behavioral analysis detecting threats can be exceedingly complex. Remember we mentioned, humans are the weakest links in security? A good AI is a great antidote to analyzing user behavior and quickly spotting anomalies.
A learning and adapting AI can make system security preemptive.