Culture and Capabilities Research
Driving a Security-Focused Mindset
Central to research efforts is raising the security acumen and practices of our employees to encourage every architect, developer, designer, and validator to think like a hacker and break what they build, through:
Immersive Mentoring
Company-wide mentoring aims to grow security leaders across disciplines and businesses. These efforts focus on training engineers in how to approach and solve security challenges and how to best balance requirements to make optimal security decisions for our products.
Security Belt Program
This multi-level training program follows industry best-practices, creating a formalized process for our employees to develop and demonstrate technical expertise across hardware and software security.
Initial belt levels focus on web-based courses, manager/mentor discussions, and participation in activities designed not only to acquire knowledge but to apply it directly to product development. These include White (awareness), Yellow (learner), and Green (practitioner) belts.
Advanced belt levels require demonstration of significant security acumen through activities such as presenting, mentoring, publishing, and innovating/enhancing product security. The levels progress from Blue (expert) to Brown (leader), culminating in the Black Belt (visionary) certification recognizing the highest levels of leadership within Intel and externally.
Purple Teaming
Specific security hackathons involving Red teams (ethical hackers looking for product vulnerabilities) working alongside Blue teams (the architect and developers who have built the products defending against potential attacks).
Security Tools
We invest in hardware automated security verification tooling for more effective testing. Hardware security is a complex, relatively new discipline; as such, well-established security assurance automation solutions aren’t available and design methodologies have not been standardized across the industry.
Intel is pioneering automation and tooling for hardware security, including new security assurance methods. One example: we collaborated with MITRE in the implementation of the first-ever, industry-wide taxonomy standard called Hardware Common Weakness Enumeration (CWE).
Comprehensive Training
Our security training program is designed to strengthen the knowledge and skills needed for employees to appropriately apply security every day in their roles, to facilitate security being part of every engineer's DNA, and to provide a strong career path for those interested in security. To do so, the training program incorporates structured pathways covering SDL practices, tools/processes, role specific technical security knowledge, and skills along with mentoring and hands-on experiences.
Security Development Lifecycle (SDL) Enhancements
SDL is always evolving to recognize the changing technology and threat landscape as well as best practices. It also evolves with the security experts at Intel as we adapt the requirements to different products and methodologies.