Beyond One Billion Endpoints Development of IT Security's
Most Important Concepts
Dr. Joerg Borchert
TCG President and Chairman

Copyright 2013 Trusted Computing Group1

Since 2005, Privacy Rights Clearinghouse reports that536,508,478 records have been breached from unencrypted
drives that were lost, stolen or hacked.

“Perimeter-intrusion detection, signature-based
malware, and anti-virus solutions are providing little
defense and are rapidly becoming obsolete—forinstance, cyber criminals now use encryption
technology to avoid detection.”-Deloitte´s 2010 Cyber Crime report
To make identity a building block of security, it must be
supported with a failsafe method of authentication whereone entity can identify another entity with absolute certainty.
This kind of authentication must be tamperproof to ensurethat identities cannot be stolen, copied, or falsified.

“Gartner, for one, is predicting the bring your own device(BYOD) phenomenon, in which employees are being
allowed to use their own personal Apple iPads, iPhones,
Google Android devices will lead to a revival of NAC...thepolicy-based network access control...”Setting course

Why TCG?
What is next?

What is TCG 2.0?

Majorimprovements
1.2 to 2.0

Commercial,
SecurityBenefits

TCG 1.2
accomplishments

3Setting course

Why TCG?

Commercial,
Security Benefits

What is next?

TCG 1.2
accomplishments
Major improvements
1.2 to 2.0

What is TCG 2.0?

4

“Better Computers” were defined and driven in the 90’s
by
- Faster computing, more storage, better graphics- Had limited connectivity- Security? …not really
Today computer SECURITY is a central criteria in every
dimension of products, usage and our society.
Pervasive connectivity exposes every node in thenetwork.

Copyright 2013 Trusted Computing Group5

Many System Components on a platform contain FW/SW-defined
security-relevant functions which can even be updated remotely•

BIOS, Option ROM, Network Controller, HD-controllers, Wi-Fi/BT chip, GSM-modem, IDE/SATA/PCIcontrollers, graphic controller, TPM-Developed: somewhere-

Manufactured: somewhere-Integrated: somewhere-How to test?

Consumer products sometimes even claim “military grade security”
Any change can make a big difference in function and security
Copyright 2013 Trusted Computing Group6

Proprietary Implementations
implementations

Proprietary
Implementations
TCG Standard
based

Unlimited interfaces

Standard interfaces

Unknown test coverage

Comprehensive compliancetest resources

Interoperability issues
Undefined, unverified Security

Clearly defined security targets,
evaluations and certifications

Big Attack Surface

Reduced Attack Surface

Copyright 2012 Trusted Computing Group7

Opennessenables

reinforces

TRUST
Transparency

fosters

DiversityofIdeas8

- Robustness and stability of specification- Participating members- Implementations in commercial products- Support in Open Source products

Copyright 2012 Trusted Computing Group9Total Membership including Commercial, Liaison, Invited Experts andGovernment participants:

135+ MEMBER ORGANIZATIONS

Complete Membership List Available: http://www.trustedcomputinggroup.org/about_tcg/tcg_members•Commercialized and available
1. High Assurance Platforms (HAP)
2. Self-encrypting drives (SEDs)

3. Network security (TNC)
4. Trusted Platform Modules (TPMs)•Applications/solutions that use TCG Technology
1. Machine Identity
2. VPN/wireless access
3. Data at rest
4. SCADA
5. Clientless endpoint meta data management
6. Hardware-based cloud subscriber management7. Trusted execution

Estimated Growth Plan - TCG Technology
1,200,000,000.00

1,000,000,000.00

800,000,000.00

600,000,000.00

400,000,000.00

200,000,000.00

-2010

2011

2012

2013

PC's

350,000,000.00

437,500,000.00

546,875,000.00

683,593,750.00

Embeded

100,000,000.00

125,000,000.00

156,250,000.00

195,312,500.00

Networking

100,000,000.00

125,000,000.00

156,250,000.00

195,312,500.00

Totals550,000,000.00

687,500,000.00

859,375,000.00

1,074,218,750.00

Copyright 2013 Trusted Computing Group13

Since 2005, over 345,124,000 records containing
sensitive personal information have been
involved in security breaches

In 2008, the average cost of a data breach was $6.65
million per affected corporation ($202 per record)$6.65 Million Per Incident

66g0
Au

Ju
n0r-06Ap-06Feb05

5-05Dec-Oc
t

5g0
Au

Ju
n0r-0
5Ap-05Feb# of reported breaches per month

Reported Data Breaches Since February 2005 to Now
4540
3530
25
20
15
10
50Source: Privacy Rights Clearinghouse

http://www.privacyrights.org/ar/ChronDataBreaches.htm

Copyright 2013Trusted Computing Group14• Transparency: SEDs come from factory with encryption key already generated• Ease of management: No encrypting key to manage• Life-cycle costs: The cost of an SED is pro-rated into the initial drive cost;
software has continuing life cycle costs• Disposal or re-purposing cost: With an SED, erase on-board encryption
key• Re-encryption: With SED, there is no need to ever re-encrypt the data
• Performance: No degradation in SED performance• Standardization: Whole drive industry is building to the TCG/SED Specs• No interference with upstream processes• User Authentication: Pre-boot (drive based) authentication; optional TPM
credential store

Copyright 2013 Trusted Computing Group15••••

Simplified Management
Robust Security
Compliance “Safe Harbor”
Cuts Disposal Costs••••

ScalableInteroperable
Integrated
Transparent“Many organizations are considering drive-level security for its
simplicity in helping secure sensitive data through the hardware
lifecycle from initial setup, to upgrade transitions and disposal”
Eric Ouellet

Research Vice President

Gartner

10/28/2013

Copyright 2013 Trusted Computing Group16

Setting course

Why TCG?
What is next?

What is TCG 2.0?

Majorimprovements
1.2 to 2.0

10/28/2013

Copyright 2012 Trusted Computing Group

Commercial,SecurityBenefits

TCG 1.2
accomplishments

1730k feet perspective:• Stronger Crypto: e.g. SHA256• Faster Crypto: ECC• More Flexible Crypto: Mandatory + Optional (extensibleLibrary)
Getting a little closer: the next 5 slides

Zoom in to Full Detail Level: attend David Wooten’ssession!

18

•

SHA1 is showing signs of weakness and is being deprecated•

Shift from RSA to ECC for asymmetric cryptography•Finding that TPMs aren’t just for PCs

Copyright 2012 Trusted Computing Group19

•

Building a compliant TPM from the TPM 1.2 specification is easy
but making them interoperable isn’t•

We find that people just don’t agree on privacy•

People will not protect their own security if you make it too hardor expensive

Copyright 2012 Trusted Computing Group20

•Promote global collaboration and provide technical solutions to address
market requirements and global interoperability through common interface•

Support publicly available and internationally recognized secure protocols
and cryptographic algorithms for commercial applications worldwide•

Fully realize the potential to offer cutting edge technology and build
global trusted computing environment•

Reduce cost of goods for vendors, developers, and suppliers, and cost ofownership for users of technology in building global trusted computing
environment and ecosystem

Copyright 2012 Trusted Computing Group21

•International/global consensus reached in critical aspects•

Specifications are partly released; others will follow shortly•

Compliance and certification program progressing well

• Members started product development; expect certified
products in 2014•

A huge effort is eyeing towards the finish line!

Copyright 2013 Trusted Computing Group22

Setting course

Why TCG?

Commercial,Security Benefits

What is next?

TCG 1.2
accomplishments
Major improvements
1.2 to 2.0

What is TCG 2.0?

23

But a few thoughts….

24

We pervasively deploy TCG technology•Trusted Computing is more than just “a TPM on a PC”

We integrate components, build “trusted platforms”•(BIOS, TXT, OS, storage, secure I/O, …)

We bring Trusted Computing in more complex systems•Servers, Virtualization, Networking Infrastructure

We connect and network the systems•

Here it is: “the internet of things” and “the cloud”

We find the balance of security and privacy•

That’s a tough one – but being OPEN is essential!

We build resilient security•Failure/incompleteness of component(s) still renders the overall security robust

25Setting course

Call forAction
Why TCG?

Commercial,Security Benefits

What is next?

What is TCG 2.0?

TCG 1.2
accomplishments

Major improvements
1.2 to 2.026

•Join the quest to develop and promote trusted
computing technologies.
•Research•Standards writing•Published studies and•continuing education•

Join to help influence developers and enterprise
end-users•

Join to become a part of the global circle of trust•

Join to take responsibility and make a difference
for the good in one of the most important andcontroversial and complex aspects of the future

Copyright 2013 Trusted Computing Group27

Dr. Joerg Borchert
Trusted Computing Group
President & Chairman
Dr. Joerg Borchert
Trusted Computing Group
President & Chairman