ARM Security Technology Building a Secure System using ...

Introduction
Many of the possible attackers can also be considered to be motivated by economic
reasoning. The biggest losses in industry originate from attacks perpetrated by
professional hackers rather than end users, and professional hackers are predominantly
motivated by financial gain. They will not invest more in a hack than they can
reasonably expect to see in financial return.
Class-breaking attacks
Many device attacks are driven by professional criminals, academic security
researchers, and enthusiasts working at home. Whether for financial gain, academic
prestige, or just for fun, these groups can focus significant amounts of time into
analyzing a system and developing complex attacks designed to break it.
The most sought after result of these attacks is a class-break; an easily reproducible
attack that can be used to break a whole generation, or class, of devices. The most
widely published attacks that fall in to this category are those deployed against
consumer entertainment devices, such as the attacks that break the software restrictions
on games consoles and the content protection schemes on DVD movies.
In many class-break scenarios in which the device hardware is attacked, the first
investigative research by the attackers may cost a significant amount. This money is
used to fund access to tools, such as electron microscopes and transistor stimulating
lasers, which are used for silicon-level analysis. The objective of such an attack is to
discover security weaknesses that can subsequently be exploited on multiple devices
without significant cost. These class-breaking attacks can dramatically shift the balance
of the economic argument in the favour of the attacker if the number of attackable
devices is sufficiently high.
Positive economics
The benefits of a secure environment are not constrained to only the technical. It has
been shown in studies that increased consumer confidence in easy to use and secure
payment systems can boost consumer spending by up to twenty percent, while also
enabling faster uptake of new revenue streams and different business models.
Manufacturers of devices are increasingly in a world where consumers have awareness
of security issues, and security features of devices are becoming an issue of competitive
differentiation. Devices with good security reviews and useful security functionality are
being chosen in preference to less well specified devices. This is especially true for
devices deployed into corporate enterprise environments, where mobile devices can
connect to the internal network. The ability to synchronize confidential e-mail and
calendar appointments to a smart phone is very useful but can, as the Washington Post
1-8 Copyright © 2005-2009 ARM Limited. All rights reserved. PRD29-GENC-009492C
Non-Confidential Unrestricted Access