It was by pure chance that I attended a security symposium at Harvard’s School of Engineering and Applied Sciences (SEAS) several years ago. I don’t know exactly what attracted me to this particular meeting of crypto minds, but it was a very fateful day in my knowledge and understanding of Cybersecurity.

Among many of the discussions held that day, one, in particular, caused me not only the excitement that usually comes with new discoveries, but also fear of the ramifications it potentially had if fully developed and exploited.

One of the more revealing discussions held by various members of the SEAS symposium was the need to develop an encrypted memory in shared environments. This is due to the ability to predict protected memory contents via the injection of rogue instructions on the CPU. In addition, the timing related to subsequent memory retrieval requests to identify previous memory states belonging to other protected programs or even other Virtual Machines.

It was agreed by all speakers of the SEAS symposium that the knowledge to take advantage of this anomaly was currently in its infancy.  Practically speaking, it was only possible in the realm of state-sponsored cyber groups and years away from becoming reality. However, the consensus was the need for encrypted memory with decryption keys held at either the program or Virtual Machine level to prevent potential disclosure of memory segments by rouge instructions.

This unchartered territory I stumbled upon that day was that not only do programs have security exploits, but the base silicone itself.  Even when functioning completely normally, without the built-in backdoors or obvious engineering flaws associated with past silicone issues, exploits are still possible. This is a scary thought.

In early 2018, fear became reality as the silicon-based exploits, Meltdown and Spectre, became known to the world.  Along with them, a new era of cyber-attacks and exploits was ushered in to seize upon this soft spot.

As proof of this new trend, I offer this evidence following the revelation of Meltdown and Spectre. In August of 2018, just eight months after the announcement of Meltdown and Spectre, the LSDS group at Imperial College London showed a proof of concept demonstrating a variant of the Spectre speculative execution routine used to defeat Intel’s SGX ((Software Guard Extensions) introduced in 2015. A very ironic revelation since Intel’s SGX is a set of extensions to the Intel architecture designed to provide integrity and confidentiality guarantees to security sensitive computations. These are performed on a system where all the privileged software is potentially malicious, such as cloud-based computing platforms.

The full ramifications of this unchartered territory have not been fully mapped.  However, rest assured both state-sponsored and individual cyber hackers are actively searching for the next silicon-based zero-day exploit.

So, what does this mean to you and your enterprise? Especially given the fact that silicon is as hard to correct as software is easy. In short, it reveals the need to re-evaluate and implement a layered security framework at all levels including network, system, and storage to protect critical data from this new generation of potential zero-day exploits. Particularly in this ever more mobile-connected enterprise world.

Given the difficulty to patch and remove silicone exploits, the goal of securing and encrypting in this layered approach is not to completely eliminate exposure but to elongate the time needed for a successful attack. This could potentially decrease the mean time to detection. This layer of the cybersecurity framework, including baseline mapping and anomaly detection solutions, becomes a critical component in the recognizing an attack. A layer without which data leakage becomes a function of time and nothing else.