Why TPM Is Ready for Prime Time
Ten years is a long time in the IT and security worlds, and a lot has changed in those years—from both an
integration/maturity and a threat perspective—that is driving increased adoption of TPM. Today, a number
of key factors is driving intense interest in TPM among enterprise security professionals and IT managers.
One of the biggest drivers is its increasing integration with Windows and Windows Mobile systems, making
acquisition costs lower. Meanwhile, threats that take advantage of software-based protections are driving
security lower in the stack.
Timing Is Everything
Here are ve top reasons why TPM is ready for prime time:
1. Embedded in Windows systems. One of the key drivers of renewed adoption is Microsoft’s
embedded support for TPM in its Windows 8 systems. Windows 8 and Windows Server 2012 are
much more tightly integrated with TPM, supporting it natively and working with the latest central
deployment and management tools in Server 2012. But TPM is no longer reserved for expensive
business-class desktops, and TPMs can be found in everything from smartphones and tablets to
inexpensive consumer-oriented Chromebooks. The software and tools needed to manage TPM are
easier to use and are integrated with Microsoft System Center 2012 system-management capabilities.
TPM is also a strong component with Windows Phone 8 and Windows RT (a variant of Windows 8
systems designed for smaller devices).
2. Growing need to secure mobile devices. In addition to securing data on Windows Mobile devices,
TPM is embedded in numerous smart devices, which is indicative of a strong push coming from
defense and intelligence agencies, as underscored by National Institute of Standards and Technology
(NIST) SP 800-164.
3
For example, Motorola’s AME 2000 and the Samsung Knox feature roadmaps that
use these platforms. Nokia Windows 8 phones that support Connected Standby (in fact, all Windows
8 devices that support Connected Standby) use TPM 2.0 (for protected storage and operational states,
which are needed for mobile devices accessing business applications).
3. New threats. Changes in the threat landscape, particularly from bootkit-based threats, represent
another factor that now makes the TPM ready for prime time. These threats—like the 2011 Mebromi
attack,
4
the rst BIOS rootkit found in the wild—usually can’t be detected by software-based tools,
because they’re situated so low in the hardware/rmware/software stack. And as far back as the 2009
Black Hat conference, a then-18-year-old researcher presented the Stoned Bootkit, which seemed
to revive the old Master Boot Record (MBR) rootkits of the late 1980s.
5
If the lessons of the past still
apply—and experience suggests they do—these threats will be increasingly “commoditized” and
widely circulated on the Internet, including the criminal underground using the dark Web.
4. Deep, wide industry support. The TPM standards-based technology has had 10 years to mature and
is now embedded—at very low cost—in the products of almost every major device manufacturer. All
ARM and Intel ATOM devices have TPM 2.0 embedded, and Intel’s release of Haswell in the near future
will mean TPM technology resides in all new versions of the Intel processors. As TPM becomes more
and more pervasive, it also has become more aordable, adding nominal costs to the price of systems
the chips are installed in (including the $250 Chromebook).
SANS Analyst Program 2
Implementing Hardware Roots of Trust: The Trusted Platform Module Comes of Age
3 http://csrc.nist.gov/publications/drafts/800-164/sp800_164_draft.pdf
4 http://mason.gmu.edu/~msherif/isa564/fall11/projects/bios.pdf
5 http://www.blackhat.com/presentations/bh-usa-09/KLEISSNER/BHUSA09-Kleissner-StonedBootkit-SLIDES.pdf
