Thirteen things that need to be good to make a secure Cross Domain Solution (CDS).
Pages
Page 15 of 15
Component integrity
A CDS should ensure that none of its components have been altered in an unauthorised way, or the design information unduly exposed.
The level of compromise protection needed for a component (from a complete CDS through to individual parts of a component) will depend on how security critical it is, and how likely it is to be compromised.
Defensive techniques
Supply chain security should be in place to ensure components are not compromised before they are installed.
Development security should be in place to ensure components are not compromised during development. Measures should be in place to monitor any 3rd Party IP (such as software libraries) used in a component for updates, to ensure they do not compromise the integrity of the component or CDS.
Secure boot for software components, with a chain of trust that fully verifies all executable code on boot up, with a hardware root. This will help to ensure software components are not compromised in operation.
The bytecode of hardware components is cryptographically signed for the device, by the supplier. This helps to ensure that hardware components are not compromised in operation.
Trusted Boot (sometimes referred to as Measured Boot) that remotely attests to the state of components should be used where possible.
The system should monitor the state of the components to ensure they are as expected. This will help to further ensure the end-to-end system is as expected.
For components where a compromise would undermine the end-to-end security of the solution, an appropriate anti-tamper solution or system should be present.
