A formally verified, secure Trusted Computing Base (TCB) and BedRock Active SecurityTM with real time introspection for continuous monitoring protects mission critical environments and data.
Criticalinfrastructure and applications are facing unprecedented security challenges due to increasing connectivity and the use of software defined data centric perimeter-less architectures. The rapid adoption and availability of virtualization provide both benefits and risk. As virtualization becomes more prevalent, attackers are shifting their focus from breaking into individual operating systems to compromising entire virtual environments. As the attack surface is growing, so is the sophistication of the nation state threat moving down the stack targeting the computing base to gain access to compromising entire systems of systems architectures.
The BedRock HyperVisor™ (BHV™) provides a Trusted Computing Base with BedRock Active SecurityTM to countermeasure (i.e. monitor, detect, remediate, restore) and reduce the attack surface. Government and critical infrastructure sectors (i.e. energy, water, transportation, telco, financial) require this as the building blocks for our global economic growth and security. Existing legacy IT/OT applications infrastructure can be extremely complex including proprietary software and hardware that was not designed to be connected – requiring modernization. To be effective solutions must reduce total life cycle cost, increase their cyber resilience while enabling the integration of legacy and greenfield environments. They must securely take advantage of virtualization, software defined, mobile/wireless, artificial intelligence, autonomous systems, cloud architectures and services to name a few.
The BedRock Systems’ solution is complementary to achieving these objectives. Providing a trusted computing base with multiple independent VM/VMM capability, we substantially increase the flexibility in the systems engineering to consolidate work/data flows, abstraction layers, API’s, and hardware to improve the security posture while reducing complexity, weight, footprint, and cost. We leverage the use of Commercial Off The Shelf (COTS) platforms that meet the most pressing design and regulatory requirements such as the ARMv8 and Intel Corp X86 supporting architectures from the edge to the cloud.
Time for a Change to Protect Your Critical Infrastructure and Applications
What is needed is a solution that is designed to meet today’s challenges in securing critical applications and infrastructure. Meeting that challenge means providing the assurance to operate effectively and safely assuming the threat is always present, and we are operating in a hostile and contested environment. In response, Commercial Enterprise and Government are pivoting to enhancing Supply Chain Security, Zero Trust and Active Resilience as part of their strategic modernization and cyber initiatives. Now is the time to integrate a TCB with the capability of continuous monitoring, detection, and the enforcement of rules/policies as the foundation for the building blocks of these future initiatives. HOW?
A Four Step Process
Reduce the Attack Surface: The first step is limiting the attack surface and providing a Trusted Computing Base (TCB) as the Foundation. This TCB must be extended to secure the VM/VMM environment.
High Assurance Isolation with VM/VMMs capable of segregating work and data flows. Applications and subsystems run, but they are granted least privilege capabilities, just those required to complete their work, rather than access to carte blanche capabilities. They cannot move freely up and down or laterally within the stack. This is called the BedRock Zero Trust Design™.
BedRock Active Security™ delivers real-time forensics, introspection and policy enforcement, complimenting applications and operating systems to fail operational, safely, and enable cyber resilience. This is the missing link for securing the foundation for Zero Trust and Active Resilience (mitigate, defend, remediate, restore) for the unmodified software up stack.
Formal Methods Proof at Scale: Instead of trying to test quality into the code after the fact, BedRock relies on the highest form of software verification using formal methods to prove the code. Based on sophisticated science, the system is first designed as a mathematical model, and then the code is proven to fulfill the guaranteed properties with a very high degree of automation. BedRock has developed unique tools to scale and extend capability to the specific use case (guest VM’s) as well as support the customer’s need for agility to provide design updates to the platforms at speed.
The BedRock Difference
BedRock is the foundation to build your future – in legacy and greenfield systems. The most secure Government and Commercial systems including critical infrastructure, mobile internet of things, telco, avionics and autonomous should be BedRockedTM. The first commercial company to offer:
- Formal Verification:
- Formally Verified Commercial Hypervisor – BedRock HyperVisor™ (BHV™)
- Autonomous Formal Verification at Scale,
- With BedRock Active SecurityTM for existing OS/Applications:
- Fine granularity for monitoring, detection and policy enforcement (at the instruction level)
- Capability to provide assessment of trusted applications real time integrating with up-stack analytics, policy/rules engines, and provide interdiction
- Zero Attack-Surface OS Policy Protection
- Application Policy and Whitelisting
How Did it All Come Together?
The computing world is more complex, dynamic, and technology accelerating at a greater pace than ever before. To take on the enormous challenge of securing critical infrastructure, BedRock has assembled the industry’s best minds from a number of different disciplines to realize the vision. BedRock Systems was founded by Ashar Aziz, the founder & former CEO of FireEye (FEYE) and is backed by renowned VCs Wing VC and Kleiner Perkins.
By Klaus Oestermann
