<p>Hardware security is vulnerability protection that comes in the form of a physical device rather than software installed on a computer system's hardware. Hardware security can pertain to a device used to scan a system or monitor network traffic. Common examples include hardware firewalls and proxy servers.</p><div class="ad-wrapper ad-embedded"> <div id="halfpage" class="ad ad-hp"> <script>GPT.display('halfpage')</script> </div> <div id="mu-1" class="ad ad-mu"> <script>GPT.display('mu-1')</script> </div> </div> <p>Less common examples include hardware security modules (<a href="https://www.techtarget.com/searchsecurity/definition/hardware-security-module-HSM">HSM</a>) that provision cryptographic keys for critical functions such as <a href="https://www.techtarget.com/searchsecurity/definition/encryption">encryption</a>, decryption and <a href="https://www.techtarget.com/searchsecurity/definition/authentication">authentication</a> for various systems. Hardware systems can provide stronger security than software and include an additional security layer for mission-critical systems.</p> <p>The term <i>hardware security</i> also refers to the protection of physical systems from harm. For example, equipment destruction attacks focus on computing and networked noncomputing devices, such as those found in <a href="https://www.techtarget.com/iotagenda/definition/machine-to-machine-M2M">machine-to-machine</a> or internet of things (IoT) environments. These environments provide connectivity and communications to large numbers of hardware devices that must be protected through hardware- or software-based security.</p> <section class="section main-article-chapter" data-menu-title="Why hardware security matters"> <h2 class="section-title"><i class="icon" data-icon="1"></i>Why hardware security matters</h2> <p>Hardware security is critical to modern data protection strategies and offers benefits across several industries and use cases. The most important reasons why hardware security matters are the following:</p> <ul class="default-list"> <li><b>Enhanced data security.</b> Hardware security devices can protect <a href="https://www.techtarget.com/whatis/definition/sensitive-information">sensitive information</a>, such as customer data and a business's intellectual property, from expensive data breaches and cyberattacks. These breaches can be costly, incur substantial penalties and damage a business's reputation.</li> <li><b>Trustworthy protection.</b> Hardware security often combines <a href="https://www.techtarget.com/searchsecurity/definition/cryptography">cryptographic</a> processes and authentication in tamper-resistant hardware. This can create a reliable trust layer on which enterprise software or a cloud system can be built.</li> <li><b>Improved management efficiency.</b> Centralized hardware security tools like HSMs can streamline the management of encryption keys and certificates, reducing complexity and human error.</li> <li><b>Business continuity support.</b> Hardware security enables uninterrupted operations, securing critical systems and transactions. This minimizes downtime risks that could impact earnings and customer trust.</li> </ul> <div class="youtube-iframe-container"> <iframe id="ytplayer-0" src="https://www.youtube.com/embed/_2MB8F9JSa8?si=9t6Y5zNknp0V97eS ?autoplay=0&modestbranding=1&rel=0&widget_referrer=null&enablejsapi=1&origin=https://www.techtarget.com" type="text/html" height="360" width="640" frameborder="0"></iframe> </div></section> <section class="section main-article-chapter" data-menu-title="How to assess hardware device security"> <h2 class="section-title"><i class="icon" data-icon="1"></i>How to assess hardware device security</h2> <p>Hardware security is just as important as software security. To assess the security of a hardware device, it's necessary to consider vulnerabilities existing from its manufacture as well as other potential sources, such as running code and the device's data input/output, or <a href="https://www.techtarget.com/whatis/definition/input-output-I-O">I/O</a>, on a network.</p> <p>Although any device should be protected if it connects even indirectly to the internet, the stringency of that protection should match the need. For example, a system controlling the color and intensity of lights in Wi-Fi LED for a dwelling might not require much security.</p> <p>In the case of more significant hardware and critical functions, the added reliability and lower number of vulnerabilities associated with hardware-based security might make it advisable. <a href="https://www.techtarget.com/whatis/definition/critical-infrastructure">Critical infrastructure</a> includes systems, networks and assets with continuous functions deemed necessary to ensure the security of a given nation, its economy, and the public's health and safety. Critical infrastructure security is a growing area of concern worldwide.</p></section> <section class="section main-article-chapter" data-menu-title="Types of hardware attacks"> <h2 class="section-title"><i class="icon" data-icon="1"></i>Types of hardware attacks</h2> <p>Gaining access to physical devices isn't as easy as conducting software-based attacks -- such as malware, <a href="https://www.techtarget.com/searchsecurity/definition/phishing">phishing</a> and hacking attacks -- but over time, cybercriminals have found ways to target hardware. While using a default password across multiple devices, outdated firmware and a lack of encryption are the <a href="https://www.techtarget.com/searchsecurity/tip/What-are-the-biggest-hardware-security-threats">biggest threats to hardware security</a>, other tailored attacks are also dangerous.</p> <p>There are several common types of hardware attacks.</p> <h3>Side-channel attack</h3> <p>This attack is notorious for stealing information indirectly, or via <a href="https://www.techtarget.com/searchsecurity/definition/side-channel-attack">side channels</a>. These attacks analyze the electric emissions from a computer monitor or hard drive for patterns of information and discrepancies in normal emissions. These discrepancies can include the type of information displayed on the monitor or the varying amounts of power that different hardware components use to carry out processes.</p> <p>Typically, the attack will try to exfiltrate sensitive information, such as <a href="https://www.techtarget.com/searchsecurity/feature/Cryptography-basics-Symmetric-key-encryption-algorithms">cryptographic keys</a>, by measuring coincidental hardware emissions. A side-channel attack is also known as a <i>sidebar</i> or an <i>implementation attack</i>.</p> <h3>Rowhammer attack</h3> <p>This cyberattack exploits a bug inside dynamic RAM (<a href="https://www.techtarget.com/searchstorage/definition/DRAM">DRAM</a>) modules manufactured in 2010 and later. Repeated accessing or hammering of the memory cells inside the DRAM releases an electrical charge that flips the neighboring bits from zeros to ones and vice versa. This lets untrusted applications gain full system security privileges and even bypass security sandboxes used to mitigate malicious code from entering and infecting operating system resources.</p> <h3>Timing attack</h3> <p>This side-channel cyberattack targets <a href="https://www.techtarget.com/searchsecurity/definition/cryptosystem">cryptosystems</a>. Cybercriminals use <a href="https://www.techtarget.com/searchsecurity/definition/timing-attack">timing attacks</a> to analyze the time it takes to respond to different inputs and execute cryptographic functions and algorithms.</p> <h3>Evil maid attack</h3> <p>Computer researcher Joanna Rutkowska coined the term <i>evil maid</i> in 2009 to signify a malicious maid trying to get her hands on electronic devices left behind in a hotel room. This attack entails obtaining physical access to unattended hardware devices, which the criminals can secretly alter to access the victim's sensitive data.</p> <p>For example, a criminal might insert a USB device with device modification software into a powered-down computer or install a <a href="https://www.techtarget.com/searchsecurity/definition/keylogger">keylogger</a> to record every keystroke the victim types.</p> <h3>Eavesdropping attack</h3> <p>This subtle data interception attack occurs when sensitive information, such as credit card numbers and passwords, is transferred from one device to another. <a href="https://www.techtarget.com/searchsecurity/answer/How-to-prevent-network-sniffing-and-eavesdropping">Eavesdropping attacks</a> succeed because no alerts are generated during transactions over unsecured networks. There are many types of eavesdropping attacks; a common one is a card skimmer inserted into an automated teller machine or a point-of-sale terminal where the attacker accesses the device occasionally to get a copy of its information.</p> <h3>Triggering fault attack</h3> <p>This attack is typically used by attackers who induce faults in the hardware to modify the device's normal behavior. The premise behind this attack is to target system-level security.</p> <h3>Counterfeit hardware attack</h3> <p>This is a type of supply chain attack in which unauthorized or fake devices are sold to organizations, creating opportunities for cybercriminals to use a backdoor to infiltrate these devices. For example, Cisco issued a <a target="_blank" href="https://www.cisco.com/c/en/us/support/docs/field-notices/723/fn72399.html" rel="noopener">field notice</a> advising customers to upgrade the software on its Catalyst 2960-X and 2960-XR switches to make sure the devices aren't counterfeit.</p> <figure class="main-article-image half-col" data-img-fullsize="https://www.techtarget.com/rms/onlineImages/security-man_in_the_middle_attack-h.png"> <img data-src="https://www.techtarget.com/rms/onlineImages/security-man_in_the_middle_attack-h_half_column_mobile.png" class="lazy" data-srcset="https://www.techtarget.com/rms/onlineImages/security-man_in_the_middle_attack-h_half_column_mobile.png 960w,https://www.techtarget.com/rms/onlineImages/security-man_in_the_middle_attack-h.png 1280w" alt="Diagram of a hardware-based man-in-the-middle attack" height="251" width="279"> <figcaption> <i class="icon pictures" data-icon="z"></i>In a man-in-the-middle attack, a cybercriminal intercepts and relays messages between the user and the web application </figcaption> <div class="main-article-image-enlarge"> <i class="icon" data-icon="w"></i> </div> </figure> <h3>Modification attack</h3> <p>Cybercriminals override the restrictions on a hardware device to carry out a <a href="https://www.techtarget.com/iotagenda/definition/man-in-the-middle-attack-MitM">man-in-the-middle attack</a>. They either inject the hardware component with malicious software or exploit existing vulnerabilities to receive and modify the data packets before sending them to the intended recipients.</p></section> <section class="section main-article-chapter" data-menu-title="Hardware security best practices"> <h2 class="section-title"><i class="icon" data-icon="1"></i>Hardware security best practices</h2> <p>Any hardware -- from outdated computers to modern <a href="https://www.techtarget.com/iotagenda/definition/IoT-device">IoT devices</a> -- can pose concerns if organizations don't follow security best practices. The following are mitigation techniques and countermeasures to follow when setting up and installing hardware:</p> <ul class="default-list"> <li><b>Investigate vendors and suppliers.</b> The risk to hardware security starts from its inception. The production of faulty hardware components can expose vulnerable devices to outside threats. To minimize the risk of counterfeit devices, it's essential to thoroughly investigate hardware suppliers before selecting them. This can include checking the vendor's suppliers and examining the parties responsible for manufacturing and integrating individual parts. Detailed inspections regarding the security measures vendors use during all stages of hardware development are also crucial.</li> <li><b>Encrypt all devices.</b> All hardware devices, including external <a href="https://www.techtarget.com/searchstorage/definition/flash-storage">flash storage</a> and DRAM interfaces, should be encrypted. Hardware encryption is essential for portable devices, such as laptops and USB flash drives, to protect sensitive data stored on them. Most modern processors have built-in components to facilitate hardware encryption and decryption with little overhead on the central processing unit, but it's best to verify. Since encryption offers multiple layers of security, even if attackers get their hands on encrypted hardware, such as a hard drive, they won't be able to access data without having the credentials.</li> <li><b>Minimize the attack surface.</b> Safe and proper decommissioning of unused hardware can help prevent unwanted hardware attacks. All decommissioned hardware and components, such as debug ports, should be disabled and disposed of properly. This can include disabling any universal asynchronous receiver/transmitters not used in the final hardware design process, unused Ethernet ports, programming and <a href="https://www.techtarget.com/searchsoftwarequality/definition/debugging">debugging</a> interfaces such as Joint Test Action Group, or JTAG, ports, and unused wireless interfaces. For those components that can't be removed, companies should consider enforcing restrictions based on <a href="https://www.techtarget.com/searchnetworking/definition/MAC-address">media access control, or MAC, address</a> or other challenges to mitigate attacks.</li> <li><b>Enforce strong physical security.</b> Companies should enforce strong access control policies in areas where hardware and physical equipment are housed. Hardware devices and peripherals shouldn't be left unattended in open areas, and devices should be secured with locked cables attached to a computer's security cable slot. Anti-tamper housing designs that make a device difficult to open without damage should also be considered.</li> <li><b>Use electronic security.</b> A comprehensive hardware security plan is incomplete without proper electronic security. This can include using a secure area to store the master key to avoid tampering and key extraction. Connected devices should be protected using authenticator devices that only authorize mutual authentication based on strong cryptography to reduce the risk of counterfeit hardware. Companies should consider using tamper and trigger switches and environmental monitoring for hardware that's prone to tampering. For example, a master key uploaded to a battery-powered <a href="https://www.techtarget.com/whatis/definition/SRAM-static-random-access-memory">static RAM</a> unit will be wiped if a tamper switch is triggered. Trigger switches can also detect light inside dark units. This locks the device whenever an attempt is made to open it.</li> <li><b>Provide real-time monitoring.</b> Hardware and operating systems need real-time monitoring using cloud-based tools. These notify the security teams immediately in response to an event, minimizing the <a href="https://www.techtarget.com/searchsecurity/definition/incident-response">incident response</a> time. Integrated platforms and IoT automation can also help provide an extensive overview of a company's hardware security status.</li> <li><b>Update firmware and upgrade old hardware.</b> Hardware devices should be upgraded to the latest firmware to get the newest security patches. Companies should also invest in new hardware, because older hardware isn't always able to run modern software optimally and can have compatibility issues, allowing for intrusions.</li> <li><b>Audit regularly.</b> Regular hardware inspections identify changes across the network and spot operational risks. Companies should conduct regular <a href="https://www.techtarget.com/searchsecurity/definition/vulnerability-assessment-vulnerability-analysis">vulnerability assessments</a> and system monitoring. For example, if a company observes a suspicious module, it should conduct an electrical analysis of the inputs and outputs after consulting with the manufacturer and in-house security experts.</li> </ul></section> <section class="section main-article-chapter" data-menu-title="Hardware security device examples"> <h2 class="section-title"><i class="icon" data-icon="1"></i>Hardware security device examples</h2> <p>There are several examples of hardware security devices. The most common include the following:</p> <ul class="default-list"> <li><b>Secure element.</b> An SE is a tamper-resistant chip embedded in devices like <a href="https://www.techtarget.com/searchmobilecomputing/definition/smartphone">smartphones</a> or smart cards that store data such as cryptographic keys and payment information. SEs are used in business applications requiring high trust, like mobile payments or identity verification.</li> <li><b>Trusted platform module.</b> The <a href="https://www.techtarget.com/whatis/definition/trusted-platform-module-TPM">TPM</a> is a small chip integrated into computers or servers. It ensures secure management of encryption keys and system integrity checks. Many enterprises rely on TPMs to protect sensitive operations and maintain trust in hardware environments.</li> <li><b>Hardware security module.</b> An HSM is a dedicated device that manages cryptographic keys and performs secure computations. HSMs are used by businesses to safeguard transactions, digital signatures and data security in high-stakes environments like banking or cloud services.</li> <li><b>Smart card.</b> These portable devices contain embedded chips that securely store credentials or authentication data. They're commonly used for employee access control or secure logins in enterprise settings.</li> <li><b>USB security token.</b> These physical devices plug into systems to authenticate users or enable secure access. USB <a href="https://www.techtarget.com/searchsecurity/definition/security-token">security tokens</a> provide an extra layer of protection for business networks and sensitive data.</li> </ul> <p><i>IoT hardware security should be taken just as seriously as other threats in the network. Learn about various security measures to </i><a href="https://www.techtarget.com/iotagenda/tip/Bolster-physical-defenses-with-IoT-hardware-security"><i>bolster IoT hardware</i></a><i>.</i></p></section>
![https://www.techtarget.com/rms/onlineImages/security-man_in_the_middle_attack-h.png">](https://www.techtarget.com/rms/onlineImages/security-man_in_the_middle_attack-h.png">){kind=link}
