3 ms·

Such blatant security holes are why Google resorts to measures like this: https://cloudplatform.googleblog.com/2017/08/Titan-in-depth-security-in-plaintext.html

• foobiekr 9y ago
  The company I founded built something very similar to a titan equipped server to allow attestation/measurement/signed logs/full external policy. I can tell you point blank that while the product we built is great, getting enterprises, the majority of whom ___still___ haven't patched eternal blue to worry about clean source, log traceability, etc. can be quite a challenging business at times. They don't understand problems with IPMI or anything else. The only thing that is going to change the face of the security market is that the loop between responsibility and inaction gets closed; as things stand today, the primary difficulty in the space is that for your average, not-very-knowledgeable customer, there is effectively no difference in mostly fraudulent security solutions and real ones - both get auditors out of your hair, so why bother buying anything real (or even not deploying anything like Comodo which actually makes things worse but still checks the box)?