Security composition in the real world: squaring the circle of mobile security with contemporary device economics

In a very short space of time consumer mobile devices have changed the way we live and work, resulting in huge amounts of sensitive data -- personal and corporate -- flowing through these tiny devices. As the value of data on these devices grows so do the threats they face, and the unique way the mobile industry works presents many challenges to achieving verifiable security while enabling an open ecosystem. Modern mobile devices are complex composed systems made up of multiple off-the-shelf components in hardware (SoC, GPU, memories), software (OS, drivers, applications) and firmware (boot stack). The devices have a relatively short life and are updated/replaced at a very fast pace, meaning that development, test and maintenance cycles are very short and major components frequently change from generation to generation. Achieving and maintaining whole system security in this scenario is extremely difficult. This keynote introduces some of the past and near future hardware assisted mobile security techniques and highlights some of the key areas of research needed to improve quality and confidence in the security of applications in these fast-evolving composed systems.