Kristian Gjøsteen <kristiag+news@math.ntnu.no> wrote in
news:aqpn85-4fd2.ln1@fimf-h28.math.ntnu.no:

> nemo_outis <abc@xyz.com> wrote:
>>And in light of that, I don't see how "careful analysis" of hardware
>>is any easier than careful analysis of software.
>
> Fact 1: Careful analysis is hard and expensive.
>
> Fact 2: The cost of a careful analysis of your security requirements
> must
> be borne by you alone.
>
> Fact 3: Suitable hardware solutions _may_ make this analysis cheaper.
>
> Fact 4: The cost of a careful analysis of commodity software and
> hardware
> can be shared by all buyers of said software/hardware.
>
> From these facts, it may follow that a hardware solution is cheaper
> than a software solution. Or it may not.
>


Neither hardware nor software should be discarded out of hand without
careful analysis and consideration of their merits and demerits for the
particular security application. And while this task may be delegated,
responsibiity for its proper execution cannot - this is a corollary of
the fact that one is always ultimately responsible for one's own
security. (Of course, delegation raises a host of other issues from
general management and supervision, through project control, to trust
and control.)

However, some broad trends emerge quickly without deep analysis, such as
that open source hardware security solutions are very uncommon while
open source software ones are far more available. This appears to
militate against using specialized hardware security solutions (except
to a limited degree) especially if the threat model includes state
actors such as intelligence agencies or law enforcement who may have
access to backdoors (indeed, may have coerced or coopted the
manufacturer into putting them there in the first place). Moreover,
even the process of acquisition of specialized security hardware may
raise one's profile to an unacceptable degree.

While there will always be exceptions to meet particular needs, I prefer
a broad strategy of open-source security software running on generic
non-specialized commodity hardware.

Regards,