Security Task Force

The Security Task Force is chaired by Olivier Van Nieuwenhuyze from STMicroelectronics. All GlobalPlatform members are eligible to participate in this group, as well as approved non-member government agencies.

Mission

The Security Task Force defines GlobalPlatform’s security philosophy and its contribution to the security landscape.

It works closely with the Crypto Sub-Task Force to monitor new trends in cryptography and examine new algorithm proposals, providing a list of algorithms and protocols based on academic publications and known organizations. This is in addition to supporting the SESIP Committee on its mission to drive the adoption and recognition of the Security Evaluation Standard for IoT Platforms (SESIP) methodology as a worldwide, multi-vertical scheme for IoT security evaluation.

Objectives

• Engage and collaborate with external security organizations to ensure that security requirements from a broad range of use cases and market sector are brought into GlobalPlatform.
• Advise the GlobalPlatform technical committees in security philosophies, cryptography, certification and applicability.
• Facilitate collaboration with government agencies and their security experts to define market requirements.
• Identify and classify secure technologies for the Internet of things (IoT).
• Maintain and update GlobalPlatform’s cryptographic algorithm recommendations table, through the crypto sub-task force.

Current Priorities

• Engage ENISA on the alignment of security levels and cybersecurity certification frameworks.
• Define how to combine GlobalPlatform technology and TPM technology (or other equivalent library).

Crypto Sub-Task Force

GlobalPlatform promotes cross industry discussion to identify and address market requirements

Mission

The purpose of the Crypto sub-task force is to evaluate and provide recommendations on the cryptographic mechanisms used in GlobalPlatform technology, to ensure high levels of security as cryptography trends and technologies evolve.

Objectives

• Analyze and report on relevant trends in cryptographic development for new markets and new use cases, as well as trends in cryptographic standardization and policies.
• Evaluate cryptographic algorithms and protocols, and suggest improvements/modifications to GlobalPlatform when appropriate
• Identify new cryptographic algorithms and protocols to be considered by GlobalPlatform
• Provide analysis and recommendations on specific cryptography topics.
• Collaborate with external industry groups and organizations, through the GP liaison process, in order to better understand and gather functional and technical requirements.

Current Priorities

• Examine hybrid crypto approaches starting with TLS, to be able to recommend a version in the near future that is acceptable with SE (and TEE) constraints, including collaboration with the GlobalPlatform IoTopia Task Force to understand impact for size-constrained embedded devices.
• Progress work on hybrid post-quantum cryptography (PQC), including a plan for the integration of new algorithms published security standards bodies including National Institute of Standards and Technology (NIST).

Software Bill of Materials (SBOM) Sub-Task Force

The SBOM Task Force is chaired by Gonda Lamberink of Fortress Information Security. All GlobalPlatform members are eligible to participate in this group.

Mission

The purpose of the SBOM (Software Bill of Materials) Task Force is to analyze the impact of, and provide guidance on, the deployment of SBOM.

Objectives

• To assess the impact of the deployment of SBOM.
• To clarify the concepts of software transparency and assurance and provide guidance, such as:
  • A consistent means to produce, consume and exchange software transparency and assurance information.
  • A guide to improve interoperability of software transparency and assurance data exchange.
• To initiate dialogue and collaborations with impacted markets such as telecoms, healthcare and automotive.
• To collaborate within GlobalPlatform and with external organizations on SBOM and other key iniatives.
• To define any necessary requirements for technology development in relation to SBOM.

Current Priorities

• Analyze impact of the SBOM and provide guidance relating to its deployment, including a consistent means to produce, consume and exchange, software transparency and assurance information.