ie8 fix
madison

It's About Time: Embedding Security in Hardware

By | August 19, 2010, 1:48pm PDT

Summary: Today’s Intel-McAfee deal — will it be a good for consumers? Does it presage more security on hardware (not just at the software level)?

Guest post from West Coast colleague Katherine Jones

Can we say “it’s about time?” Can Intel successfully move computer security into hardware rather than separate performance-diminishing software add-ons that users turn off because they are so annoying? The acquisition of McAfee can point the way to embedding security components into the hardware elements rather than as software riding on top of them. As Intel’s largest acquisition ever at $7.68 billion (and its second this week), it is interesting because of the possibilities it creates – and the questions it raises about embedded security:

• Will hardware-level security lessen agility to address new viruses or malware quickly?
• How will embedded security affect hardware pricing? Everyone will want it – but not to pay extra for security they think should be theirs already!
• Is there a performance down-side to chip-level security measures?
• Can multi-level security be embedded in a typical chip? Is this the future for phones and notebooks?

If this move can eliminate the annoying, time-consuming in-your-face updates, system-check pop-ups that accompany system slowdown, and reminders to renew or expect catastrophe – and possibly present better security than users have today, it’s a good one.

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

Topics

Brian is currently CEO of TechVentive, a strategy consultancy serving technology providers and other firms. He is also a research analyst with Vital Analysis.

Disclosure

Brian Sommer

I am co-owner of TechVentive, Inc. The company has been engaged on numerous consulting engagements, often for technology firms, service firms and litigators. As a general rule, I do not write about current clients of TechVentive. Should that occur, I will note this in blogs. Readers should assume that I have had client relationships with many ERP and other technology providers. Some of these relationships may be quite small and short-lived while others more significant. One of TechVentive's business units publishes research reports about technology providers. As a result, this business receives small amounts of revenues from a wide variety of software firms, software buyers and others when they purchase copies of reports. Some firms do secure reprint rights to these reports. None of these purchases, individually, represents a significant amount of total revenue for me and the nature of it is hard to predict where it will come from. I also provide some marketing strategy and/or market segmentation work for software firms as I have developed a unique database that segments the largest 4000+ technology buyers in the world. Many technology firms periodically engage me for unique views into this database for future marketing campaigns. I do not blog about these efforts and do not blog about client firms while they are active clients unless some pressing news story erupts. If that event occurs, I will indicate any perceived or real conflict of interest. Occasionally, I will develop unique intellectual property pieces for technology or service providers. If I should blog about a vendor with whom I have recently developed a special information product, I will note this in a blog to avoid any appearance, real or unintended, of bias. For the most part, I have no investments in technology firms. While I've been offered friends and family stock and other inducements in the past, I have steadfastly refused these. I used to be a partner with Andersen Consulting and had no ownership stake in the firm for many years. I frequently refer to this in my blogs and do not hide my prior association with the company. I did purchase a few shares of Accenture and Cognizant stock in late - 2008. I have sold some of those positions in late 2009. Readers should assume that most software conferences that I write about involved some measure of fees waived and/or travel reimbursement. I do not charge vendors to attend these events nor will I accept payment for same. I do get reimbursed for many speaking engagements. I generally note at the end of blogs whether the vendor reimbursed me for travel expenses. Generally, this includes airfare and hotel. I do not request, receive nor accept travel perks such as first class airfare.

Biography

Brian Sommer

Brian is in a unique position to diagnosis the winners and the losers in technology and services. He was the longest running (10 years) and most senior director of Andersen Consulting's (now Accenture's) global Software Intelligence unit - a position that required him to pick the best possible software solutions for hundreds of clients globally. He advised the firm on ERP software market forecasts and helped establish manpower planning estimates by vendor for deployment globally.

Brian continues to remain close to technology buyers and sellers. When he left Andersen Consulting, he co-created a dot-com with blogger and former arch-enemy at Price Waterhouse, Vinnie Mirchandani. That firm helped broker efficient services contracts between software buyers and systems integrators. Since then, he's created TechVentive, Inc. - a company that helps technology firms better understand their markets - and Vital Analysis - the research and publishing arm of TechVentive.

Brian still travels the world and publishes an impressive number of articles, research reports and blog posts annually to help software and services buyers make better business decisions. He can be reached at: brian @ vitalanalysis.com

10
Comments

Join the conversation!

Just In

RE: It's About Time: Embedding Security in Hardware
katherine.jones 20th Aug 2010
@druid627@... ...hence my cost question!
0 Votes
+ -
Is it really possible?
peter_erskine@... 20th Aug 2010
As all non-admin users need the right to delete files, its hard to see how a chip could distinguish between intended and malicious actions.
0 Votes
+ -
@peter_erskine@... This is another question I should have added to my list!
0 Votes
+ -
Great, let's add more complexity
zackers 20th Aug 2010
As Intel puts more and more stuff in hardware, the prospect of accidentally wiring in a bug that let's someone get root access just becomes greater. Except if that happens, chances are there won't be a software patch. Millions of computers could be permanently open to exploitation.

Intel's biggest asset is security through obscurity. Nobody except the engineers at Intel really know what's in there. Chip designs go through extensive verification to make sure that they work as intended. But how much testing do they do to check unintended code sequences or subtle race conditions at different clock speeds don't expose a bug? In the software world, it's the unintended uses of a program that expose most of the bugs. Does anybody believe all those millions of transistors work exactly as intended? Isn't there a point of diminishing returns with increasing complexity? I often get the feeling Intel throws stuff like this into the chip simply because they have the real estate with shrinking transistors and can't think of anything useful to do with it.
0 Votes
+ -
@zackers You may be right -- we could end up with a"spaghetti code" as in the older ERPs -- on a chip.
Nonsensical article. Security checks always require knowledge of information content and context. Though there are many "hardware levels", most hardware is ignorant of content/context at a high enough level that any kind of security checks could be implemented.
0 Votes
+ -
@mlenox True, but I think the levels of classified security -- a la DoD--could be chip-enabled, don't you?
now mcafee won't be abble to slip a virus under the tabble in a bar with some cash to hackers. when they need a new revenue stream.
0 Votes
+ -
@JOHNNYYY DId they do that?
0 Votes
+ -
A few questions to ponder...
druid627@... 20th Aug 2010
Does this mean that now when you buy an Intel machine, you have to pay them again for the on board security, for the life of the machine? Will you be able to use a different security suite with it?

... and the EU is going after Microsoft for monopolistic practices? This move aught to bring Intel more scrutiny than before.
0 Votes
+ -
@druid627@... ...hence my cost question!

Join the conversation!

Formatting +
BB Codes - Note: HTML is not supported in forums
  • [b] Bold [/b]
  • [i] Italic [/i]
  • [u] Underline [/u]
  • [s] Strikethrough [/s]
  • [q] "Quote" [/q]
  • [ol][*] 1. Ordered List [/ol]
  • [ul][*] · Unordered List [/ul]
  • [pre] Preformat [/pre]
  • [quote] "Blockquote" [/quote]
ie8 fix
Click Here
ie8 fix

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Facebook Activity

White Papers, Webcasts, & Resources
ie8 fix
ie8 fix