IDC NetVista Manual Download Page 14

14 #3577  ©2003 

IDC 

Unlike software encryption, which can't keep a counter, the chip can keep track of log-
in attempts, and it won't let the count-per-time rise too high, interpreting repeated 
assays as hammering behavior. Each failed attempt increases the length of the delay 
before a user can try again — up to 28 days. Although this feature can be reset with 
an administrative passphrase, it functions as a good antihacking mechanism. 

The user key is not used for signing anything but allows the chip to load keys from 
elsewhere. Unlike a smart card, the chip can work with multiple certificates (issued, 
for example, by a senior citizens group, a corporate employer, Microsoft Outlook, 
American Express, or MasterCard). The number of keys can get quite large since 
each organization a user might interact with will have its own. 

O N E   E L E ME N T   O F   A   S E C U R IT Y   S U IT E  

With one of the security factors thus based in embedded hardware, dual-factor client 
security systems can include, as mentioned previously, a biometric authenticator or 
proximity badge to further hinder identity spoofing and lunchtime attacks. Tied to 
third-party authentication tools, embedded hardware security can plug some of the 
more vulnerable holes in the security perimeter. For example, the range of a proximity 
badge, which operates over a radio frequency link, can be configured from five feet — 
for really secure — to 30 feet — for still pretty secure protection against lunchtime 
attacks.  

In the Targus biometric recognition implementation, a spring-loaded PC Card–based 
device with a small reader on it pops out with a finger push. The device reads the 
user's fingerprint, which is used initially to set up access, and if it finds a match, 
permits log-on. The software included with the device lets the user map any 
application requiring a password to this surefire authentication system. 

The security chip, which is now available worldwide, is designed to be used with other 
security elements. For example, it will not protect against a virus that can wipe the 
hard disk clean. Firewalls and antivirus software are required for that type of defense. 
The chip just keeps data private and confidential and provides for PKI operations. 
IBM and other vendors offer suites of interrelated security products to create a fully 
secure environment. For example, IPSec protects communications links by securing 
the Ethernet controller. 

Another key feature of the IBM-embedded security chip is that it is inexpensive — to 
the point where IBM has included it in select client systems at no additional charge to 
the buyer. The company charges about $25 for the chip to commercial buyers, which 
is less than the cost of the simplest hardware token (e.g., a USB key) and one-half to 
one-third the cost of the least-expensive smart card. For the degree of utility it 
provides in 

de novo

 installations, nothing else can match it on a price-performance 

basis. Hardware-based solutions implemented as cards are more expensive — in 
some cases up to $2,000 — and a perpetrator could put a sniffer on some 
aftermarket cards. Also, the chip ties the trust to an actual PC rather than to a 
removable card. The only possible way to hack the chip is by direct physical attack 
(and even this involves such "high-spook" work that only a very few cryptoanalysts, 
mostly employed by the dark sectors of governments, can even think of mounting 
such as assault), which involves sensing voltage changes on the power lead and 
gives only an indirect view of activity inside the chip. A successful malicious hack 
cannot be launched remotely. 

The only penalty that an organization might pay for using encryption of any sort — the 
IBM chip or another hardware or software implementation — is that the process 
creates some computing overhead. However, today's PC systems — based on 
multigigahertz processors, generous and faster memory, and wider and faster system 
buses — have more than enough power to compensate for this performance "tax." 

With one of the 
security factors thus 
based in embedded 
hardware, dual-factor 
client security 
systems can include, 
as mentioned 
previously,  
a biometric 
authenticator or 
proximity badge  
to further hinder 
identity spoofing and 
lunchtime attacks. 

Summary of Contents for NetVista

Page 1: ... sophisticated organizations are vulnerable In one incident widely reported in the press that had an impact of major but unknown proportions the degree of penetration was difficult to assess a hacker from St Petersburg the intellectual seat of the old Soviet Union broke into Microsoft s network and absconded with a large number of important files including purportedly an unknown quantity of Window...

Page 2: ...ugh IBM acted unilaterally to design and implement its hardware solution key players in the industry have acknowledged the design point The TCPA was inaugurated with IBM Hewlett Packard Compaq Intel and Microsoft as founding members Since its inception in October 1999 more than 190 firms have signed up including Dell TCPA wants its security technology to be universal in the computing industry and ...

Page 3: ...issues How the PC client can be the weak point in the security perimeter The rise in the value of data stored in insecure computing systems The scope of security measures Security history and current technology Client security implementations The advantages of IBM s hardware security implementation The evolution of industry standards for client security U S A G E L A G S B E H I N D T E C H N O L ...

Page 4: ... to the corporation financial personnel and proprietary technical data whether it lies in the mainframe on the network or in clients at the low level of client protection most of the focus has shifted to ensuring that the cordon sanitaire is unbroken at the access point and that user files are secured Good mainframe security implementations particularly at the procedural level have been in place f...

Page 5: ...ter more now than it has in the past Until recently few organizations had a need for systematic data security Banks and other financial institutions had to ensure end to end security for storing and moving money around over wires Certain government agencies could only operate in an impregnable data fortress But the volume of valuable data being stored and transmitted by most firms was relatively l...

Page 6: ...ted But until that moment they had been engaged in an operation that had hacked into banks and ecommerce sites and extorted the operators for money with the promise of not revealing the hacks to the public Sometimes the value of reputation damage is difficult to assess but it may represent the entire value of the business Another Russian hacker was monitored for years as he downloaded millions of ...

Page 7: ...ublic key encryption and its associated infrastructure address the issue of trust at the global level Of the many elements that make up a total security solution however PKI is the most dependent on completeness that is any two parties participating in secure transactions must both agree to rely on a third party a trusted authority sometimes called a certificate authority It is because of the comp...

Page 8: ... break this code without the key a decipherer has to try 2 56 or 72 057 594 037 927 936 combinations 72 quadrillion for those intimidated by the sight of large numerals and because of the dynamism of the DES algorithm it is extremely difficult to reduce the size of the search space search space reduction being one of the more important techniques at the disposal of decipherers other than by luck U...

Page 9: ...atter of jargon a one time key is called ephemeral The more robust method used to encode the AES keys is called asymmetric or public key cryptography The asymmetry refers to the fact that mathematically related but different keys are used for encoding and decoding When the private key is used to encrypt a message only the associated public key can be used to decrypt it When the public key is used ...

Page 10: ... encode the symmetric key i e the AES key used for bulk data encryption The result of encoding the symmetric key with an asymmetric public key is called a digital envelope and the process is referred to as PKI key exchange IDENTIFYING THE SENDER AND GUARANTEEING DATA INTEGRITY We now have an infrastructure robust enough to guarantee the identity of the sender The sender is fairly confident of the ...

Page 11: ...we utilize this powerful math C L I E N T S E C U R I T Y I M P L E M E N T A T I O N S Because of the unresolved procedural issues involved with implementing a fully secure infrastructure some of the grander visions of secure computing have been scaled back at least in the short term Companies need not wait until all parties agree on all aspects in order to shore up their security perimeters Even...

Page 12: ...o commandeer a PC will let the intruder scan the contents of main memory and find the user s private key Back Orifice is good at masking itself encrypts its own outgoing traffic and was released in source code about two years ago at a hackers conference The nCipher program can find a 1 024 bit private key the best in commercial use And if a malicious hacker can get your private key he can get your...

Page 13: ...he authorized user and that his or her local data is protected from intruders A HIERARCHY OF KEYS One of the greatest strengths of hardware security architecture is the hierarchical nature of its key management system The first key pair generated is used to protect another key pair called the platform identity key pair This key pair is created under the system owner s control and can be used by th...

Page 14: ...st a virus that can wipe the hard disk clean Firewalls and antivirus software are required for that type of defense The chip just keeps data private and confidential and provides for PKI operations IBM and other vendors offer suites of interrelated security products to create a fully secure environment For example IPSec protects communications links by securing the Ethernet controller Another key ...

Page 15: ...code named Palladium now being created by Microsoft Palladium which will incorporate TCPA s work will handle a wide variety of content and client security functions including many such as digital rights management for copyrighted material outside the scope of the TCPA specification Version 1 2 will be implemented in conjunction with future processor and chipset families from Intel and others and w...

Page 16: ... user chooses Wireless Application Protocol WAP encryption the Wireless Transport Layer Security WTLS protocol which is a derivative of Secure Sockets Layer SSL is invoked This protocol begins with a secure certificate exchange between wireless nodes Within a single node the chip can be used at will for individual local file and folder encryption Files and folders can also be encrypted or decrypte...

Reviews: