Enforcing Runtime Integrity with Maat - Jonathan Myers & Andrew Guinn

Описание: Enforcing Runtime Integrity with Maat - Jonathan Myers & Andrew Guinn, Johns Hopkins University Applied Physics Laboratory
This talk presents Maat, a tool for runtime integrity measurement and appraisal. While existing tools provide integrity measurement to account for kernel boot and kernel module loading, they do not detect or protect against unauthorized modifications or malware infections after system startup. Runtime integrity measurement and appraisal allows integrity check throughout the lifecycle of system execution. Maat is an open-source framework and tool that enables and provides runtime integrity measurement suitable for critical Linux systems, as well as general-purpose use on desktop or server Linux machines. This talk will cover the goals and challenges of runtime integrity measurement, including multi-layered measurement and appraisal of a running system including hypervisor, OS and userspace; the challenges of performing trustworthy measurement on a potentially compromised system; the design of Maat; and other practical use cases enabled by Maat.