Manufacturing and Provisioning

00:00

Hi, I'm Matthew Clark and this is Module six. Secure build, ship and operate. Congratulations. We've completed Module five. This slide shows our progress towards our certificate of completion. Let's begin our new module with less than 6.1 manufacturing and provisioning,

00:19

and this lesson will look at insecure manufacturing.

00:22

We'll discuss common provisioning, missed aches and also how to address those using the i. O. D SF framework. So let's get started.

00:31

We've discussed the manufacturing process all throughout this course, and as a review was discussed, some of the threats and impacts to that process.

00:40

Well, let's start with counterfeiting. And this could include knockoff devices made of cheap materials and containing flawed execution code.

00:48

As the fake devices might not perform very well, it might actually be a safety issue in some cases.

00:54

So what are some of the impacts that a manufacturer could expect? Well, they could see direct loss, as in a loss of revenue as people by the counterfeits instead of the actual product.

01:04

Or it could be an indirect loss. You could incur brand damage, especially if people associate the inferior product to the actual product or if there's a significant newsworthy event that people tie back to your product.

01:19

Second, you could have production overruns where it's your product running your code. It's made from your materials, most likely at your expense. Um, but somebody else reaps all the reward. The impacts will direct loss, a loss of revenue because you're paying for someone else to sell your product,

01:37

even even if they pay for the materials, you're still losing the sale,

01:41

and your customers are going experience problems. For example, warranty issues could be a problem for customers who think they've purchased that actual product and then try to use the warranty on Lee to find out that there's no record of the sale.

01:53

The third is the loss of intellectual property,

01:57

and this is where someone else steals your code firmware secrets and uses it to build their own similar product. And now you have competition at little or no cost on their side.

02:08

And remember, threat actors do not have to subvert factory management. To do this. They cannot go after a very few select employees on the factory floor that air close to the process.

02:20

Threat actors could be opportunists that could be competitors or organized crime

02:25

you could have component substitution. XYZ This is where the contract manufacturers sourcing cheaper components

02:32

but building you for the higher priced components.

02:36

And what are the impacts for that? Well, you could have performance issues because these are not the components that you specified with your design.

02:43

It could lead to a direct loss a drug loss of revenues. As the device doesn't perform as advertised or expected, you could cause safety issues. Um, you could have, like a sub par lithium battery that could have caused problems for the customer by catching fire.

03:00

It could cause indirect loss, brand damage due toa all those things that we just talked about and, of course, unintentional actions. This covers pretty much everything that's not necessarily a malicious in nature. I've worked in manufacturing industry for my entire career, and factory workers there great paid on production sometimes.

03:19

But they may feel pressure to bypass some security measures in order thio improve their throughput or to meet their own production targets. And that might affect security, which may or may not be picked up during testing. Your cue? A. If it's picked up during testing, then you're gonna run into production delays.

03:35

And if not, then you could have an inferior product going out to market.

03:38

And all these have major impacts, and we kind of went through them as we went through those threats. Um, but each one of these kind of leans toward loss of revenues or unknown behavior of the device affecting brand damage. Right?

03:52

And of course, you need to think about your suppliers to because they can make or break you because they are actually the extension of you and their actions reflect on you not necessarily themselves right, cause it's your name is gonna be the one who's associate it with any issues. Again. You can transfer responsibility, but you can never transfer accountability.

04:12

Generally, some part of the provisioning process has to be exposed by the O. E M. To the contract manufacturer.

04:18

The economics of designing, building, marketing and selling and i o t widget dictate that not every decision could be made without some sort of compromise

04:29

insecurity. We really exist on that edge balancing functionality with risk tolerance,

04:34

and it's likely that the cost of manufacturing will attempt some OM to seek partnerships in geography. Is that have lower cost.

04:43

Oftentimes thes geography zehr far away from where the OM conducts their regular business, making it hard to ensure, or at least a test that production practices air always followed.

04:55

So stable connectivity may not always possible. So the OM may elect put in HSM or other component of their provisioning system on site,

05:03

which works as long as the contract manufacturer could be trusted. Otherwise, you have to design a secure service.

05:12

Rahm would authored a white paper called Secure Device Provisioning Best Practices

05:16

Heavy Truck Edition for the NCC Group, and in it he outlined several common mistakes that caused provisioning systems to fail. And I'll share several of his ideas with you here on this slide. But I've included a link to his paper and I recommend it to you. Please look at it,

05:32

he said. One of the first things was shared provisioning secrets using the same secret key and every device, Uh, trust on first uses another issue, and we've discussed this briefly before. But this is where a trust relationship has formed between unknown parties. For example, when a new device connects,

05:50

the greatest vulnerability in this process is the risk of a threat. Actor inserting themselves into it. Forgery through forgery and a man in the middle attack.

06:00

Plain text key provisioning is something else to look for.

06:04

Secrets are created offline and then added to the devices. The risk would be if those secrets or not encrypted in transit across the network or at rest while stored on a provisioning, USB key or shared directory somewhere

06:18

UN authenticated debug boards is another one that rob poop pointed out.

06:24

This involves physical access to the device.

06:27

The vulnerability would be if the debug ports are not protected. And we've discussed various ways to do that,

06:32

which would allow privileged access.

06:34

Then this is bad, especially if there's no authentication required

06:40

and insufficient entropy is another one. The strength of the key is built on its ability to be unpredictable. This is like having a password that you think is secure because you increments the number at the end each time you change it

06:54

and manufacturing this would be like using the date. Time field is part of the key generation process. Ke re use is another one that Rob points out. We talked at length about different ways that roots of trust can be created and how encryption forms and anchor of trust.

07:11

And that anchor gets weak when you reuse keys or overuse keys. Remember in dice, for example, the private device I D Key is never exposed outside of the first mutable code.

07:20

And in TPM, the endorsement key is used only for very specific purposes.

07:27

In his white paper, Rob Wood points out that keys that are used for both signing and encryption can lead to the compromise of the keys themselves.

07:35

Do you appreciate A cryptography is another one using obsolete cryptography, cryptographic algorithms, modes and key sizes. You know, those were just asking for trouble, especially after they've already been compromised.

07:48

Secret algorithms is the last one. When I studied for the C. S S P exam years ago, Kelly held her hand, drilled it in my head that open algorithms are there are more secure than secret proprietary ones because everyone has a chance to independently verify unopened algorithm strength.

08:07

So do yourself a favor and don't try that at home. Don't make your own secret algorithm or, worse yet, think that obfuscation is cheap and effective solution.

08:16

It's cheap, but it's not very effective

08:18

and hiding something is just delayed discovery.

08:22

So the i o t s f in their security compliance framework outlines several things that manufacturers could do to address these threats and concerns using an escrow service storing the encrypted I p. And I'll say location is one logging all the devices that are manufactured,

08:41

um, production testing is performed in using a secure boot. That's Ah, third one, as well as making sure that all the production tests and calibration software is removed

08:52

Additionally, using a secure location and process the revision devices. Um, not having global secrets secrets are unique to the devices. Um, making sure that ownership proof is extended along the supply chain and having an audible bill of materials.

09:09

Well, that's it for this lesson.

09:11

In this lesson, we took a brief trip into the mysterious world of manufacturing and provisioning. We talked about insecure manufacturing issues. We discussed briefly the provisioning risk,