Enable trusted execution
Summary
Developers should implement and enable trusted execution if it is available on the device's System-on-Chip (SoC) or CPU.
Description
Enabling and implementing trusted execution, especially when available on the device's System-on-Chip (SoC) or CPU, is important for several security reasons. Trusted execution environments provide a secure and isolated space within a device's hardware to run sensitive operations, protecting them from potential threats including malware, rootkits, and privilege escalation attempts.
Supported In
This requirement is verified in following services
| Plan | Supported |
|---|---|
| Essential | 🔴 |
| Advanced | 🟢 |
References
- CWE™-693. Protection mechanism failure
- CWE™-1192. System-on-Chip (SoC) using components without unique identifiers
- CWE™-1233. Improper hardware lock protection for security sensitive controls
- OWASP TOP 10-A5. Security misconfiguration
- Agile Alliance-3. Deliver working software frequently
- MITRE ATT&CK®-M1038. Execution prevention
- PDPO-9A_66G. Powers exercisable in relation to premises and electronic devices
- CMMC-CM_L2-3_4_9. User-installed software
- CMMC-SI_L1-3_14_5. System & file scanning
- FedRAMP-AC-6_8. Least privilege - Privilege levels for code execution
- FedRAMP-CM-7_5. Least functionality - Authorized software, whitelisting
- ISO/IEC 27002-8_19. Installation of software on operational systems
- ISA/IEC 62443-UC-2_4. Mobile code
- NIST SSDF-PW_6_1. Configure the compilation, interpreter, and build processes to improve executable security
- CAPEC™-681. Exploitation of Improperly Controlled Hardware Security Identifiers
- ISO/IEC 27001-8_19. Installation of software on operational systems
Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your 21-day free trial and discover the benefits of the Continuous Hacking Essential plan. If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' hacking team, fill out this contact form.