It seems like almost every week, yet another hardware security vulnerability is announced. Just last week a team of researchers disclosed a new attack called “Platypus”, an acronym for “Power Leakage Attacks: Targeting Your Protected User Secrets.” This is another attack exploiting the simple fact that hardware sits below the conventional security abstractions and finding a vulnerability in hardware can cause an enormous impact up the stack.
According to the National Vulnerability Database, there has been an exponential growth in hardware vulnerabilities over the last few years. These exploits are becoming more widespread, dangerous and costly than ever, and are coming from new attack vectors like we just saw with Platypus. It comes as no wonder that hardware security is becoming a design signoff for most new ASICs and SoCs. The challenge is coming up with the signoff criteria. This is where a special interest group, that brings together experts and experience, focused on hardware security could really help pave the way.
In July of this year, Tortuga Logic announced that I was appointed to the newly established Common Weakness Enumeration (CWE™) / Common Attack Pattern Enumeration and Classification (CAPEC™) Board*. For those that are not aware, CWE is sponsored by the U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) and maintained by The MITRE Corporation (MITRE).
Since the Board’s formation, as you would expect, there have been several discussions on various topics relating to CWE/CAPEC. One topic of great interest was that there were three ongoing, independent, yet synergistic efforts to provide hardware security assurance standards to the industry. This discussion was the basis of MITRE’s decision to form a new Hardware CWE Special Interest Group (HW CWE SIG).
The HW CWE SIG has been established as a forum for researchers and representatives from organizations operating in hardware design, manufacturing, and security to interact with a common goal. The goal is to share opinions and expertise and leverage each other’s experiences in supporting the continued growth and adoption of CWE as a common language for defining hardware security weaknesses. With over 40 representatives across both commercial and government including NVIDIA, Lattice Semiconductor, Accellera, Intel, Battelle, Bosch, BAE, Synopsys, and Tortuga Logic to name a few, the HW CWE SIG is off to a brilliant start.
The formation of the HW CWE SIG has also brought together representatives of the three independent security assurance standards teams. The first is the Accellera IP Security Assurance Working Group which kicked off in 2019. The group’s mission is to create standards for hardware IP security risks when integrating into larger systems. The working group is chaired by Intel and Synopsys and includes several contributors including, NVIDIA, Qualcomm, Cadence and Tortuga Logic.
The initial scope for the Accellera Working Group was to define an automated systematic approach to leveraging existing IP standards, for specification, design, verification and integration where security risk is a concern. The Working Group has published an initial IP Security Assurance Standard white paper providing insight into those key focus areas. Now with the formation of the HW CWE SIG, many of the same companies and team members on the Accellera working group are represented on both teams. This provides a valuable venue for the IPSA group to acquire insight into adjacent hardware security initiatives and ultimately strengthen the outcome.
Shortly after the formation of the Accellera Working Group, in a parallel effort, MITRE announced CWE 4.0, which for the first time, included a taxonomy of common hardware weaknesses. The effort launched in February 2020 after a significant push from Intel and MITRE and has grown with many additional hardware CWEs being added since its inception. The current 4.2 release now documents 75 hardware-focused CWEs. For this effort MITRE, once again, tapped some of the key companies focused on hardware security such as Intel and Tortuga Logic to develop and document hardware CWEs. These companies are now all part of the HW CWE SIG as well.
In the meantime, the US Government’s Department of Defense also started a parallel project called the Hardware Vulnerability Database, which focuses on cataloging hardware vulnerabilities of interest to the government. Representatives from this initiative have also joined the HW CWE SIG to provide insight on overlapping areas that are of interest to the government.
Finally, during this same time period, Tortuga Logic began documenting a hardware security CWE methodology and guide. Our Radix™ security verification solution can now detect and prevent 80% of the hardware CWEs, pre-silicon. By leveraging a common Hardware CWE list, hardware security and development teams can now take advantage of a 5-step CWE Validation process to streamline threat modeling and security verification, prior to committing an ASIC or SoC to silicon. This methodology was well adopted in the application security domain to effectively build secure software to reduce business risk and our security team has done a fantastic job to enable this same process for hardware design.
*The CWE/CAPEC Board includes representatives from the following organizations: Cloud Security Alliance, Consortium for IT Software Quality (CISQ), Cybersecurity and Infrastructure Security Agency (CISA), GrammaTech, Intel, MicroFocus, MITRE (CWE/CAPEC Board Moderator), National Institute of Standards and Technology (NIST), Open Web Application Security Project, SANS, Synopsys, Università Degli Studi di Milano – Bicocca, Veracode in addition to Cycuity.