AMD Gave Google Cloud Rare Access to Its Tech to Hunt Chip Flaws

#Discussion(Security) [ via IoTGroup ]

An unusual partnership between Google and AMD may offer a blueprint for how the tech industry can better tackle processor security risks before they spiral out of control.On Tuesday Google Cloud is releasing a detailed audit of AMD’s confidential computing tech the result of a collaboration between Google’s Project Zero bug-hunting group two teams within Google Cloud Security and AMD’s firmware group.

The audit follows years of Google Cloud putting increasing emphasis on its offerings for Confidential Computing—a suite of capabilities that keep customers’ data encrypted at all times even during processing.The stakes are high as customers increasingly depend on the privacy and security protections conferred by these services and the physical infrastructure underlying them which is built on special secure processors from AMD.Flaws in how processors are designed and implemented pose massive risks turning widely used chips into single points of failure in the computers servers and other devices in which they’re installed.

Vulnerabilities in specialized security chips have particularly dire potential ramifications because these processors are designed to be immutable and provide a “root of trust” that all the other components of a system can rely on.If hackers can exploit a flaw in security chips they can poison a system at that root and potentially gain undetectable control.So AMD and Google Cloud have developed an unusually close-knit partnership over more than five years to collaborate on auditing the Epyc processors used in Google Cloud’s sensitive infrastructure and attempting to plug as many holes as possible.“When we find something and know that the safety is getting better that’s the best ” says Nelly Porter group product manager of Google Cloud.Porter says the partnership with AMD is unusual because the two companies have been able to build up enough trust that the chipmaker is willing to let Google’s teams analyze closely guarded source code.

Brent

Read More..
AutoTextExtraction by Working BoT using SmartNews 1.03976805238 Build 04 April 2020