Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud Security //

Google

8/25/2017
04:33 PM
Simon Marshall
Simon Marshall
Simon Marshall
50%
50%

Google: Big Cloud, Tiny Titan Chip

Google develops a tiny chip to close a big security hole before it opens. Is there a tiny Titan in your future, too?

If you take a slice through Google's Cloud Platform, you'll see Google-designed components everywhere. Google hardware, Google-controlled firmware stack, Google-curated OS images, a Google-hardened hypervisor, coupled with an intimidating physical presence at its data centers. Google is so concerned about security that it likes to build its own kit.

This self-sufficiency ethos was reinforced as it unveiled the technical detail behind its new Titan security chip. Google is talking about this now, even though the chip was launched earlier this year, because the chip has spent some time in the wild in Google data centers and the results are promising.

Google is aiming big with its tiny chip; it's designed to close hardware security back doors before they're even opened. If the chip finds something anomalous, it won't even let the hardware boot. That approach seems like a sledgehammer, but it's designed to defeat strong, evolving exploits from nation states.

"That level of adversaries certainly have an incentive to hack or to have influence over the security of hardware," said Dan Cornell, principal at Denim Group, a firm that builds secure systems for technology companies. According to Cornell, the chip-led approach is timely as nation states gear up for cyberwar.

Titan is a secure, low-power microcontroller created to ensure that systems always boot from the last known good state. Using verifiable code, Titan establishes the hardware root of trust for cryptographic operations in Google's data centers by verifying the firmware/software stack before booting -- allowing or disallowing access to network resources based on the result. If there's been a hardware/firmware tamper, the system just isn't allowed to wake up.

This is particularly effective in countering a new crop of firmware attacks, which, for example, target rewritable firmware chips such as a BIOS chip or hard drive controller. While BIOS manufacturers are addressing this problem, Google has gone a step further and designed an approach that pulls the power plug before anything even comes on line. Titan boots its own firmware first, and only then allows the host firmware to boot.

The chip is another building block in Google's attempt to punch-up its security creadentials and try to narrow the gap with leaders AWS and Microsoft Azure. However, Google was quick to stress that the chip is only one component of its all-round security in the cloud. Certainly, Google does not expect the chip to be the main money-spinner.

"We're not pinning our hopes on this as (a separate) investment. The most important thing to note is that Titan is one piece of the puzzle, and Google Cloud delivers end-to-end security," said a Google spokesperson.


You're invited to attend Light Reading's 11th annual Future of Cable Business Services event. Join us in New York on November 30 for the premier independent conference focusing on the cable industry's continuing efforts in the commercial services market -- all cable operators and other communications service providers get in free.

Google declined to respond to questions related to the total cost to develop Titan, or whether it would consider licensing or selling the technology to other companies.

Simon Marshall has worked within and around the telecom and IT industries for 21 years. Simon cut his teeth as editor-at-large at totaltelecom.com in the late Nineties, drove strategic communication and product marketing plans for Qualcomm, Neustar and Redknee during the Noughties, and lives today as a technical consultant, active tech news junky and content underwriter at Security Now.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/2/2020
Ripple20 Threatens Increasingly Connected Medical Devices
Kelly Sheridan, Staff Editor, Dark Reading,  6/30/2020
DDoS Attacks Jump 542% from Q4 2019 to Q1 2020
Dark Reading Staff 6/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9498
PUBLISHED: 2020-07-02
Apache Guacamole 1.1.0 and older may mishandle pointers involved inprocessing data received via RDP static virtual channels. If a userconnects to a malicious or compromised RDP server, a series ofspecially-crafted PDUs could result in memory corruption, possiblyallowing arbitrary code to be executed...
CVE-2020-3282
PUBLISHED: 2020-07-02
A vulnerability in the web-based management interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified Communications Manager IM & Presence Service, and Cisco Unity Connection could allow an unauthenticated, remote attack...
CVE-2020-5909
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, when users run the command displayed in NGINX Controller user interface (UI) to fetch the agent installer, the server TLS certificate is not verified.
CVE-2020-5910
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the Neural Autonomic Transport System (NATS) messaging services in use by the NGINX Controller do not require any form of authentication, so any successful connection would be authorized.
CVE-2020-5911
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller installer starts the download of Kubernetes packages from an HTTP URL On Debian/Ubuntu system.