<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div><span></span></div><div><meta http-equiv="content-type" content="text/html; charset=utf-8"><div><span></span></div><div><meta http-equiv="content-type" content="text/html; charset=utf-8"><div><span></span></div><div><meta http-equiv="content-type" content="text/html; charset=utf-8"><div></div><div>On Aug 7, 2018, at 22:56, Trevor Woerner <<a href="mailto:twoerner@gmail.com">twoerner@gmail.com</a>> wrote:</div><div><br></div><blockquote type="cite"><div><div dir="ltr">Hi Rich,<br><div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Aug 6, 2018 at 3:02 PM, Rich Persaud <span dir="ltr"><<a href="mailto:persaur@gmail.com" target="_blank">persaur@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="auto"><span class=""><div></div></span><div>Several "boot integrity" videos have been posted, which cover SRTM and DRTM:</div><div><a href="https://www.platformsecuritysummit.com/2018/topic/boot/" target="_blank">https://www.<wbr>platformsecuritysummit.com/<wbr>2018/topic/boot/</a></div></div></blockquote><div><br></div><div>Thanks for keeping us updated on the progress. I watched Bruce's video last week; his talk and the quality of the video was great. Thanks for making these public!!</div><div><br></div><div>At today's Technical Meeting, someone mentioned that Google recently announced some sort of security framework? Does anyone have a project name or links?</div></div></div></div></div>
</div></blockquote><div><br></div><div>Google Cloud Shielded VMs, see #3 and #4 below.</div><div><br></div><div> <a href="https://cloud.google.com/shielded-vm/">https://cloud.google.com/shielded-vm/</a></div><div><br></div><div>Rich</div><div><br></div><div>---</div><div><br></div>Summary: services can authorize device/VM connection if the managed device/VM can prove through certificates and/or runtime cryptographic measurements that it is executing a known-good stack of hardware, firmware and software. This can be done on a resource basis, e.g. access to a sensitive spreadsheet or document, within a "zero trust" or "software defined perimeter" network architecture.<div><br></div><div>1. BeyondCorp: <a href="https://www.blog.google/products/google-cloud/preparing-for-a-beyondcorp-world-at-your-company/">https://www.blog.google/products/google-cloud/preparing-for-a-beyondcorp-world-at-your-company/</a></div><div><br></div><div>2. Cisco/Duo: <a href="https://duo.com/blog/beyondcorp-for-the-rest-of-us">https://duo.com/blog/beyondcorp-for-the-rest-of-us</a><br><br><div>Google Cloud:</div><div><br></div><div>3. Shielded VMs: <a href="https://cloud.google.com/blog/products/gcp/security-in-plaintext-use-shielded-vms-to-harden-your-gcp-workloads">https://cloud.google.com/blog/products/gcp/security-in-plaintext-use-shielded-vms-to-harden-your-gcp-workloads</a></div><div><br></div><div>4. vTPM 2.0: <a href="https://cloud.google.com/blog/products/gcp/virtual-trusted-platform-module-for-shielded-vms-security-in-plaintext">https://cloud.google.com/blog/products/gcp/virtual-trusted-platform-module-for-shielded-vms-security-in-plaintext</a></div><div><br></div><div>5. Titan root of trust: <a href="https://cloudplatform.googleblog.com/2017/08/Titan-in-depth-security-in-plaintext.html">https://cloudplatform.googleblog.com/2017/08/Titan-in-depth-security-in-plaintext.html</a></div><div><br></div><div>6. Vendor-agnostic root of trust for measurement: <a href="https://static.googleusercontent.com/media/research.google.com/en//pubs/archive/46352.pdf">https://static.googleusercontent.com/media/research.google.com/en//pubs/archive/46352.pdf</a></div><div><br></div><div><br></div><div>Microsoft Azure-Windows:</div><div><br></div><div>7. Hardening with Hardware: <a href="https://youtube.com/watch?v=8V0wcqS22vc">https://youtube.com/watch?v=8V0wcqS22vc</a></div><div><br></div><div>8. Windows SystemGuard: <a href="http://alex-ionescu.com/Publications/OPCDE/octagon.pdf">http://alex-ionescu.com/Publications/OPCDE/octagon.pdf</a></div><div><br></div><div>9. Azure-Windows runtime attestation ("<span style="background-color: rgba(255, 255, 255, 0);">leveraging device and user trust claims to gate access to organizational resources")</span>: <a href="https://cloudblogs.microsoft.com/microsoftsecure/2018/06/14/building-zero-trust-networks-with-microsoft-365/">https://cloudblogs.microsoft.com/microsoftsecure/2018/06/14/building-zero-trust-networks-with-microsoft-365/</a></div><div><br></div><div>10. Azure Sphere for IoT (hardware RoT, 10 years of Microsoft Linux security updates): <a href="https://azure.microsoft.com/en-us/blog/introducing-microsoft-azure-sphere-secure-and-power-the-intelligent-edge/">https://azure.microsoft.com/en-us/blog/introducing-microsoft-azure-sphere-secure-and-power-the-intelligent-edge/</a></div><div><br></div><div><div><span style="background-color: rgba(255, 255, 255, 0);">11. MS OpenCompute Cerberus: <a href="https://youtube.com/watch?v=wCMplDQLsfw">https://youtube.com/watch?v=wCMplDQLsfw</a></span></div><div><br></div></div><div><br></div><div><br></div><div>(small advertisement: OpenXT uses OpenEmbedded in an open-source platform for device assurance and runtime attestation, so that vendors and customers can make geographic and industry-specific choices for device keys, certificates and trust hierarchies. Some features, e.g. measured boot, are being unbundled so they can be used by other projects. We are working towards an upstream-first, CI workflow with OE meta-virtualization and Xen)</div></div></div></div></div></body></html>