Hardsec: A Cyber Security Safety Net

Hardsec can work in tandem with more software focused strategies. The premise of hardsec sits at the core of the physical system, protecting components of the machine.

Why business need to be thinking about securing hardware

As we know, a cyber security breach can drastically affect a company's bottom line, shut down national infrastructures or impact the privacy of millions, subjecting them to potential exploitation and theft. So how can hardsec help protect against these threats? A 2018 report issued by The Council of Economic Advisers states: 

Hardware is a less inviting target to hackers than software for a number of reasons:

• Hardware is less easily accessible
• Hardware is not as well understood (as software)
• Attacks against hardware must be highly specialized

Therefore, the benefits of building security into hardware are:

• Ensures trust in end devices and components rather than building software on top of these devices and components that can be exploited
• Hardware will be more difficult to exploit, as it requires a deeper technical understanding, is more time consuming, and requires access to the hardware from the source
• Hardware is “dumb,” which sounds like a negative, but means there is a vastly reduced attack surface

Securing hardware can add a physical layer of protection to software’s transformation that substantially increases the difficulty for threat actors trying to modify it for criminal purposes. With this in mind, it’s important to note that hardsec isn’t the only solution; cyber security frameworks and software protections are invaluable - both Governments and big businesses require their use. However, an incorporation of hardware security can build a foundation for other security measures to stand on and ensure protection for the basic building blocks of computer and system security as well as a more protected supply chain of system components.

Hardsec is the future of business security

The UK Research Institute in Secure Hardware and Embedded Systems (RISE), which is partially funded by the National Cyber Security Centre (NCSC), has stated its focus “is to accelerate the industrial uptake of the Institute’s research output and its translation into new products, services and business opportunities for the wider benefit of the UK economy.” 

This statement is indicative of a shift to other methods of developing security. We are seeing companies considering security implications outside of software and moving towards adoption of a more holistic approach. Hardware has vast capabilities, especially when concerned with developing solutions for situations that have challenging performance and scalability requirements.

At Nexor, we are investing heavily into new methods of protection as we believe that implementing hardsec will result in fewer data vulnerabilities due to built-in fail-safe protection measures and anti-tamper mechanisms which locks the hardware down and reverts it to a safe state when it has been improperly tampered with. Security functions are inherent in the hardware, avoiding the risk of vulnerabilities that might be found in unpatched software versions or holes in software, which require constant monitoring and fixing.

Additionally, there exists a reduced attack surface for hardware, even if a threat actor did manage to break part of it, it wouldn’t necessarily break the whole thing. With software, there are ways to escalate privileges, in that once the threat actor is root, it’s game over. Hardware, can’t be “owned” in the same way as software, as it must be physically accessed in order to reprogram it to run malicious code. 

Incorporating hardsec into your cyber security strategy isn’t a definitive answer and it isn’t going to prevent attackers trying to infiltrate systems, but it will provide security and resilience in the face of attackers. If implemented correctly, it can adapt and create a robust system which protects business interests and data. Hardsec can work in tandem with other measures of security to help secure a business from various angles of attack, and these technologies can, and should, be adapted and developed as required by the ever-changing nature of the cyber security ecosystem.