Cyber Resilient Technologies (CyRes)

Mission

The mission of TCG's Cyber Resilient Technology (CyRes) Work Group is to explore and develop technologies and best practices that improve the resilience of computing devices by applying trusted computing concepts. Our vision is to set the industry baseline for how vendors and customers can build and respectively leverage protection, detection, and recovery capabilities to meet stakeholder expectations for resilience from the platform level up.

What the group does

The CyRes Work Group develops specifications, reference documents, and implementation models for protection, detection, and reliable recovery of a wide range of programable and updatable devices, from computing platform components and sub-components to small, standalone IoT devices. The key focus areas in the Work Group are:

• Protection for code and configuration information that determines platform capabilities.
• Detection mechanisms for malware and deprecated or corrupted configuration data or code.
• Recovery capabilities that can reliably patch both code and configuration in a given device.

The CyRes Work Group aims to define cyber resilience Building Blocks (BBs) and composition profiles that can be used to create platform-specific Cyber Resilient Modules (CRMs) in collaboration with other TCG workgroups such as Server, PC Client, and IoT.

Why it matters

Computing devices today are subject to an extensive array of attacks such as Distributed Denial of Service or malware that tries to persist inside individual computing modules or platform components. For example, malware can tamper or erase executable code and/or configuration files needed to boot or to provide expected platform functionality. The outcomes can have severe implications: prevent computing devices and platforms from functioning, inhibit recovery or repair, or potentially cause widespread disruption. Furthermore, such malware could potentially harness device capabilities and orchestrate attacks on other entities such as cloud services, communication infrastructures, and power grids. Given the dramatic expansion of computing and intelligence in a broad spectrum of platforms, if such attacks occurred at scale, it would be challenging or impossible for responders to recover devices to restore their intended functionality or to prevent attacks lateral movement. Oversights during product development, operational mishaps, non-expert customers, or aging technology could also cause damage or outcomes equivalent to malware attacks. The Cyber Resilient Technologies Work Group's guidance helps developers to address such challenges and align with regulations and publications such as the EU CRA and NIST SP800-193 through technology means.

Who participates

The CyRes Work Group brings together experts from component manufacturers, device integrators, OS vendors and system builders, which bring embedded and system security expertise to collaborate on technologies that serve a broad range of computing-enabled markets such as IoT, PC, Server, Automotive, Aerospace, and more.

Technology the group develops

The CyRes Work Group develops technologies that operate at different levels of the device integrity lifecycle:

• Protection technologies aim to lessen the likelihood that malware is able to persist itself and enable better protection of the code, data, and recovery information. For example, different kinds of protection latches can be deployed to control the read and write permissions over storage or memory.
• Detection technologies help to identify whether a platform is not healthy, possibly even when the device is disconnected. They can be local or remote, such as Secure Boot or Remote Attestation techniques respectively.
• Finally, Recovery technologies aim to complete the device integrity lifecycle by enabling to reliably bring the device back to a state of Protection. For example, several types of watchdog counters can transfer the control to a Resilience Engine that performs the actual recovery actions.

Key deliverables

While the CyRes Work Group has produced a Cyber Resilient Module and Building Block Requirements specification, it is currently working on restructuring the specification to better address target audiences as follows:

• Cyber Resilience Building Blocks specification: targets subsystem engineers at Building Block maker companies, and aims to provide detailed requirements for how to design components as foundational building blocks that provide cyber resilience capabilities.
• Cyber Resilience Architecture: targets architects at module maker companies, and aims to explain how building blocks are combined in a cyber resilient module architecture to address a given threat model.
• Cyber Resilient Module Templates: targets product integrators and consumers, and explains how Cyber Resilient Modules provide real-world resilience using design patterns appropriate for the device type.