Version History

EMB3D Releases

Version 2.0

This is the first update since EMB3D reached content completion with the Mitigations release last fall. Since we started releasing the EMB3D model last year we have received a lot of fantastic feedback from the community. Since the Threats and Properties have been available the longest, we spent much of our effort this release on refreshing those and addressing comments and suggestions.

On the Mitigations side, we completed a set of new entries on different ways that formal methods approaches can address various threats ranging from parsers to operating system internals. Two other new mitigations pair with the expanded threats related to logging. Several existing MIDs were expanded with additional techniques and references.

Finally, we’ve been asked for this a lot and can finally make it available. EMB3D is now packaged up in a machine-readable format. We picked the STIX 2.1 standard as its data model captures most of the EMB3D data set well. We also hope choosing STIX makes it easier to integrate EMB3D with other threat and vulnerability tools and data sets.

Head on over to the Resources->Data page in the nav bar for documentation and the download link.

Changelog

  • Added STIX-format machine readable form of the dataset
  • Properties
    • New:
      • PID-28 - Device stores logs of system events and information
      • PID-34 - Device stores logs of application events and information
    • Revised:
      • PID-33: Renamed to “Device includes interactive applications, services, or user interfaces” to better capture the intent of that branch of the property tree.
  • Threats
    • New:
      • TID-225 - Logs can be manipulated on the device
      • TID-226 - Device leaks security information in logs
    • Revised:
      • All: Revised evidence and CVE links for greater consistency including:
        • Fixing or replacing broken links to the CISA KEV database.
        • Normalizing all CVE links to point to the cve.org site.
      • All: Updated stale and broken reference links.
      • TID-[206, 207, 212, 216, 223, 225, 316, 318, 325, 408, 411]: Every EMB3D Threats is now mapped to a relevant CWE entry.
      • TID-103: Renamed to “Microarchitectural Side Channels” and scope broadened accordingly. The previous scope of “cache timing side channels” did not accurately capture what we intended.
      • TID-110: Expanded description scope and evidence to include additional examples beyond Rowhammer.
      • TID-111: Changed description wording for clarity.
      • TID-113: Clarified description to be more precise.
      • TID-119: Added examples in addition to JTAG.
      • TID-207: Reworded description for better clarity.
      • TID-208: Reworded description for better clarity.
      • TID-210: Changed maturity to Observed Adversarial Behavior.
      • TID-216: Changed maturity to Observed Adversarial Behavior.
      • TID-301: Fix incorrect AT&CK for ICS reference link.
      • TID-310: Added additional examples to description.
      • TID-323: Renamed to “Path Traversal” to more broadly capture the problem in non-HTTP environments.
      • TID-328: Expanded description with additional examples.
      • TID-404: Fixed incorrect CWE link.
      • TID-408: Expanded description and increased maturity to Observed Adversarial Technique.
  • Mitigations
    • New
      • MID-084 - Restrict Sensitive Data from Logs
      • MID-085 - Export Logs Over the Network Off of Device
      • MID-086 - Hardware Enforcement of Memory Access
      • MID-087 - Utilization of Formally Verified OS (Micro-)Kernels
      • MID-088 - Formally Verified Parsers
      • MID-089 - Formal Methods Verification of Critical Functionality Implementation
    • Revised
      • All: Updated stale and broken reference links.
      • MID-[20, 49, 61, 66, 83]: New and modified references.
      • MID-009: Renamed and clarified to include runtime integrity tools that aren’t exclusively kernel-based.
      • MID-010: Revised the name.
      • MID-014: Added content on sandboxing using WebAssembly.
      • MID-028: Added discussion on Physical Unclonable Functions (PUFs) as another technique.
      • MID-060: Added commentary cross-referencing to side channel resistance.
      • MID-065: Minor wording change in description.

Acknowledgements

The EMB3D team thanks the following people who’s comments, feedback, and contributions helped with this release:

  • Ahmed Walid Amro
  • Bryson Bort
  • Eric Cornelius
  • Kenneth Crowther
  • Dr. Amit Elazari
  • Christopher Gates
  • Diane Golden
  • Nicholas Lograsso
  • Alex Matrosov
  • Paul Noalhyt
  • Aleksey Nogin
  • Thomas Pace
  • David Shelly
  • Luke Thomas
  • Radhika Upadrashta