DARPA wants more secure hardware

The Defense Advanced Research Projects Agency wants to test the proposition that more secure software starts with more secure hardware.

DARPA's new System Security Integrated Through Hardware and Firmware, or SSITH, program aims to tackle software security at the hardware level, according to a DARPA news release.

"Security for electronic systems has been left up to software until now, but the overall confidence in this approach is summed up in the sardonic description of this standard practice as 'patch and pray,' " said SSITH program manager Linton Salmon of the agency's Microsystems Technology Office.

SSITH focuses on seven classes of hardware vulnerabilities listed in the Common Weakness Enumeration, a crowd-sourced compendium of security issues. These classes are: permissions and privileges, buffer errors, resource management, information leakage, numeric errors, crypto errors, and code injection.

Removing these hardware weaknesses "would effectively close down more than 40 percent of the software doors intruders now have available to them," Salmon said.

More In IT and Networks

‘Made-in-America’ drone maker Neros awaits its big Pentagon break

The company aims to increase its production capacity from 1,500 drones per month to 10,000 by the end of this year.

Researchers home in on origins of Russia’s Baltic GPS jamming

Analysts have been tracking Russian electronic warfare from across the Gdańsk Bay, pinpointing familiar sites in Kaliningrad.

Space Force rethinking plans for proliferated satellite communications

The service is studying alternatives to the Space Development Agency's Transport Layer, which is providing small satellites for tactical communications.

Tech firm uses AI to make Pentagon budget, spending easier to track

Obviant's platform aims to help both DOD and the defense industry better understand how the Pentagon is spending its money.

Opinion

Five priorities for advancing NATO’s space mission

NATO’s progress in the "final frontier” is notable but insufficient, argue RAND analysts Anca Agachi, Shaan Shaikh and Bruce McClintock.