CCSI

CCSI Officer course · Module 01 of 10

Threat models and the trust boundary

Why data in use is the gap that encryption at rest and in transit leaves open, who confidential computing defends against, and how to draw the trusted computing base for a real system.

← Syllabus

Narrated module overview · captions available2:01 · 1.4 MB

Learning objectives

  • Explain the three states of data and which one confidential computing addresses
  • Name the adversaries a TEE is and is not designed to stop
  • Draw a trust boundary and list everything inside the trusted computing base (TCB)
  • Write a short, testable threat model statement for a confidential workload

Lessons

  1. Lesson 1.1 · 12 min

    Data in use: the missing third state

    Encryption at rest and in transit are routine. Confidential computing targets the moment data is decrypted to be processed.

  2. Lesson 1.2 · 14 min

    Adversaries: who a TEE defends against

    A precise list of in-scope and out-of-scope attackers, so that you can read vendor claims critically.

  3. Lesson 1.3 · 15 min

    Drawing the trust boundary and TCB

    A repeatable method for drawing the boundary, enumerating the trusted computing base, and writing a testable threat model.

Start lesson 1.1

Check your understanding

Answer each question to see instant feedback. Pass mark 80%. Your best score is saved in this browser.

Module 1 quiz

6 questions · pass mark 80%

  1. 1.Which state of data does confidential computing specifically protect?

  2. 2.According to the Confidential Computing Consortium definition, which element is essential besides a hardware-based TEE?

  3. 3.Which adversary is generally OUT of scope for a TEE?

  4. 4.An application with a SQL injection flaw is moved into an enclave. What is the effect on the flaw?

  5. 5.Where should TLS normally be terminated for a confidential workload?

  6. 6.Why is the attestation verifier considered part of what you trust?

Glossary

TEE
Trusted Execution Environment: a hardware-protected execution context whose memory is isolated from software outside it.
TCB
Trusted Computing Base: all components that must behave correctly for a security property to hold.
Trust boundary
The line between components you trust and components you treat as potentially hostile.
Side channel
Leakage of secret information through observable effects such as timing, cache state, or power, rather than direct reads.

Official documentation