Risk Model for Choosing Signature Thresholds for Software Updates

The timely installation of software updates has become an accepted best practice for protecting connected systems from persistent threats. Modern software update frameworks and trust anchor management protocols allow for the use of multiple digital signatures on update messages to protect against the potential compromise or loss of a digital signature private key or compromise of the underlying digital signature platform. The choice of whether to use multiple signatures and the specific number of signatures to use should be based on a risk assessment. We have developed a probability model that provides relative risk metrics for several different policy and system design options that include multiple signatures. The model enables system architects and operators to make a risk-based decision when considering multiple signatures to protect critical software updates.