Cautious Optimism and Grave Concerns as Intel Integrates Cybereason into Chips

Intel and Cyber Reason just announced that they are working to integrate Cyber Reason into the vPro CPUs to collect data from hardware and software with the goal of protecting users from ransomware. Now, this is an opportunity for better cybersecurity, but it could also lead to a catastrophic undermining of trust or create an avenue for devastating external attacks. On the upside, and I've been talking about this for the better part of a decade, that security embedded in the CPU has the best visibility of everything running on the system, and it's really difficult for hackers to access. That is a tremendous home field advantage, but there are downsides as well. And one question we have to ask is, does ransomware protections truly need access at the hardware layer? Mm, likely not. Probably the OS layer is sufficient, but access at the hardware level by Cyber Reason or any other endpoint protection technology does assist in detecting other types of attacks, malware, things of that sort. Ransomware really is for the most part, just another piece of malware, uh, that does a specific function. The benefit of Cyber Reason integrated at the hardware level is broader than just addressing ransomware, but so are the risks. And the drawbacks include that if the security functions themselves are compromised or misused, the resulting malicious activity would be near impossible to detect, and it could compromise everything in the system— the operating systems, the application, the data— and it might even be impossible to fix if hijacked. So it represents a security, privacy, safety risks, especially when there's a tremendous reliance on a third-party company. So Cyber Reason is in the business of detecting and responding to endpoint malicious software. That requires a lot of visibility and access. In this case, well, by an independent third party, and that's something Intel has to take into consideration. Now, those risks can be managed, but forethought is absolutely needed to clearly define what are the features and limitations. So for example, um, you know, what's the compartmentalization and access for controls of this system? Uh, what is the ability to turn it on or off or even remove the functionality? Or if the customers, uh, want a different vendor, what is their ability to replace replace it with a vendor of choice. Many of the controls must be defined for what metadata or what information, what telemetry can leave the device and what can be gathered and processed. You know, all these are very, very important because again, it could compromise the system and all the secrets of the users. So it is important to think about all of that ahead of time. Now, this is not the first attempt by Intel. Intel has developed many specific security functions that exist in the hardware. These include accelerators, code checkers, key functions, secure storage, and even secure enclaves, right? Um, and as for integrating with a third-party security software company. Well, that's also been tried, right? Intel tried this hardware plus security software with its failed acquisition of McAfee many, many years before. And the idea was to embed McAfee's anti-malware directly on the chips, and the entire brain trust of Intel couldn't make it work. And the problem was not the engineering can it be done challenges, but rather the strategic cyber security acumen of asking the questions, should it be done and how? And without those insights, you know, you tend to go down a path that isn't going to return really what you want it to be. And Intel has the engineering chops, so it's not a matter of can they embed software or functionality into hardware, into silicon. Absolutely they can. But I'm concerned that they're probably likely short on the security understanding piece. The question of should you do this and how, right? They've got to do that risk calculus that would determine the long-term meaningful value, and that's difficult. Such an integration would likely require embedding Cyber Reason Code some level of access, control, conditional awareness, and also data exfiltration functions of some kind. And it could just be alerts, it could be telemetry data, or it could be a whole host of other information that might even include, include data samples sent back for further analysis. And that kind of access and data could easily fingerprint everything about a system, including what's running, configurations, applications, data, user secrets, all sorts of things. Uh, attackers could use those functions to do all manner of bad things. They could manipulate the system that could trigger all sorts of activities, including forced patching, reboots, uh, blocking of certain functions, uploading of new code, maybe even malicious code, all of which are tools that could be used, well, for good or for malice. There are benefits and risks, and the key to which way the needle will tip will be determined based upon the limitations and controls that are implemented and the guardrails that are established. Many Intel vPro customers already don't like some of the built-in administrative functions in the vPro line, which is, uh, Intel's business line of CPUs. And this new functionality could give undesired access to unauthorized parties. For an example, um, a search for security concerns of Intel's Active Management Technology functionality. A search like that will turn up all sorts of issues and concerns, right, that we've seen in the past, that people talk about, and because of which many customers have chosen not to actually activate the vPro functionality. So a poor integration of Cyber Reason could greatly exacerbate those concerns and introduce a whole new level of vulnerabilities as part of a supply chain attack. Now, Lior Dev, and he's the CEO of Cybereason, he's a smart guy. If there is a lack of strong strategic oversight on behalf of Intel, Intel, I mean, Lior is going to push as much as he can for the most amount of access integration as possible. And to be honest, I mean, that's great for cyber reason, and there's a potential ability to detect risks and do all sorts of great things, but it's not necessarily in the best interest of Intel's business customers nor the downstream users that they support. So a key tenet of security is to only possess the minimum necessary access to deliver the desired level of risk mitigation. And Lior, as smart as he is, will want much more than that. And this can be seen in the Cyber Reason announcement that they just made, where he outlines a number of wide-ranging additional benefits and use cases. He has a plan. His corporate mission is to end cyber attacks, and that is noble. That is absolutely noble. But to do that, he's going to want and need tremendous access and control of Intel's hardware. What is needed in this partnership is to make sure the benefits outweigh the risks, um, that there is a clear set of integration parameters, objectives, and limitations for the access and control functions. There must be a strong strategic guidance by Intel to set the clear parameters not based upon what could be done, but rather what should be done from a cybersecurity perspective. If Intel does not have this level of cybersecurity skill in place, then disaster is in the cards. If they do, then that team should have already done this analysis and documented it all. It would be trivial to sanitize that and make it public., and such designs and discussions, well, they need to be opened up for everyone to evaluate anyway if you want trust to be earned. Otherwise, this is just another hidden function that could be a catastrophe for users, far worse than the recent SolarWinds attack. So Intel, if you have done your due diligence, then produce the guidelines, the designs, and the operating parameters. Such details won't undermine the security efficacy, as true security doesn't derive from obscurity. The information can then be evaluated by the cybersecurity community, which would likely be more than willing to provide more insights and recommendations. I mean, we're all on the same side. And poor technology choices, even with the best intentions in mind of doing something beneficial for security, it can cause great harm in the end. It's better to identify and deal with malign security choices early than to try and clean up the mess afterwards. If Intel does not have that level of forethought, analysis, and security strategy handy, then they've been running blind, and, well, we all should be worried.