Formed in June 2018, the TCG Cyber Resilient Technology (CyRes) workgroup focuses on supporting three primary principles for resilience:
Protection techniques lessen the likelihood that malware is able to persist itself and provide techniques for better protecting code and data. Detection techniques identify whether a platform is healthy and work when the device is disconnected, using standalone techniques (like secure boot), or connected, by using technologies like remote attestation. Detection involves the creation of evidence about the kind of platform and where a verifier could obtain health information. If detection identifies a problem, recovery is triggered to remedy the platform and try to return it to a functional state. Remediation could involve updating code or changing security settings.
For connected cyber resilient platforms, the protection, detection and recovery capabilities help identify misconfigured or unpatched code and reliably deploy updates. For consumer scenarios this may be done directly by the manufacturer, service provider or end user. In organizational settings, management may be done by the IT department or its delegates. Policies may be defined for recovery actions that are device and domain specific.
The CyRes workgroup intends to develop new technologies, promote existing best-practices, and coordinate efforts in other groups inside and outside TCG. The goal is to improve the resilience of future platforms by applying trusted computing technologies.
The concepts of using protection, detection and recovery to support resilience are not new. Many existing techniques and solutions work to address them in different ways today, often in a platform specific or proprietary manner. The output of the CyRes workgroup will generally be platform independent. CyRes plans to formalize concepts of widely useful resilient technologies, specify building blocks and recommend baselines to meet stakeholder expectations for resilient computing platforms and their subcomponents. Complex platforms could have a mixture of subcomponents with varying levels of resilience and interdependencies.
The output of the workgroup will complement other publications on resilience. For example, the NIST SP 800-193 publication has technology independent requirements for resilient platforms that could be met in a plethora of ways. The CyRes workgroup will develop TCG technologies to provide protection, detection and recovery capabilities in the context of end to end scenarios. In conjunction with other TCG platform workgroups, the workgroup may help TCG publish resilient requirements for specific classes of platforms.
The Cyber Resilient Module and Building Block Requirements Version 1.0 Revision 0.2 specification has been published in August 2022, introducing the overall CyRes architecture, requirements for an initial set of CyRes building blocks such as watchdogs and latches, as well as several CyRes module profiles for different industry scenarios. Currently, the CyRes workgroup is working on a second version of the specification, seeking to include support for persistent resilience engines that are active after the boot process is completed, as introducing improved CyRes building blocks, as well as reorganizing the specification to align content to various roles such as engineering, architecture, product management, and technology consumers.