Key Benefits
Our reliance on digital infrastructure is continuing to increase at an accelerating pace at a global level. The computing network and communications infrastructure has been undergoing major architectural transformation with the transition to public and private cloud computing, billions of internet-connected devices, the introduction of 5G, and general-purpose computing elements and applications that we rely on for critical operations. As the world becomes increasingly reliant on it’s digital platforms, we must ensure that the foundation is robust against malicious attacks and that any vulnerabilities in the computing base don’t grant the “keys to the kingdom” to would-be attackers.
BedRock believes that to achieve this, computing must be built on a rock-solid foundation. A trusted computing base that is mathematically proven unbreakable to minimize the attack surface and provide a solid foundation of trust from the edge devices to the cloud. Our formally verified trusted computing integration framework guarantees the Bare Metal Properties™ which are essential for establishing a trusted virtualization layer with high assurance isolation at scale and the capabilities required for Active Security™ (Virtual Machine Introspection (VMI) and policy enforcement).
As a capabilities based framework each VM/VMM is assigned specific resources to execute its tasks with full isolation eliminating any lateral movement or scanning/mapping by an adversary. Our Active Security™ takes advantage of this by providing the capability to deny or allow the VM from executing any instruction that does not comply with policy. Consistent with the principals of Zero Trust, this enables the extension of least privilege to least functionality.
Enforcing the concept of least functionality with BedRock provides a local policy wall that prevents the execution of malware versus monitoring and detection applications that rely on analytics to detect malware signatures, have large overheads limiting some implementation, and tend to lag malware execution requiring mitigation and restoration. In Zero Trust architectures BedRock provides a complimentary capability to enforce policy locally to prevent, log events, and federate the information to support situational awareness, AI, ML, analytics and dynamic policy management.
The BedRock trusted virtualization layer enables feature capabilities never before available.
Command and Control Information Systems
Command and Control Information Systems (CCIS) rely heavily on automation, with electronic equipment and computer networks as their primary components. A truly secure CCIS requires both integrity and availability. The BedRock Hypervisor provides these through software-defined architectures and cloud-like backend systems.
Drones
Be it for border control and surveillance, or to protect the airspace over airports and public events, highly autonomous drones have become the only viable option. Because of their high criticality and need to assure and protect the mission and its data, they need to be impenetrable and fail operational even when under cyber attack. Their highly sophisticated software for machine learning and advanced sensing, usually based on vulnerable stacks such as Linux, needs active security and monitoring to keep them on mission. BedRock provides both impenetrable safety and security against attacks to devices and CCIS, as well as active security with policy enforcement to protect the vulnerable applications, OS and containers, without the need to change them.
Ultra Secure Mobile
Ultra Secure Mobiles, like dual persona devices, allow for two separate, independent user environments on a single device. The BedRock Hypervisor ensures security conscious mobile devices, even in “bring your own device” scenarios. Availability and integrity are guaranteed, down to the resource partitioning of hardware devices involved in securing the different operating modes of the device. Active Security Policy ensures the defined behavior and protection of data based on a formally secure foundation.
Secure Workstation
Intelligence requires absolute security, guaranteed separation, and a defined flow of information. This is easily achieved with the BedRock Hypervisor. Formally proven separation and resource and communication policy can be managed and archived at the hypervisor level, assuring a secure workstation from any location.
Secure Cloud Infrastructure
As decentralized financial services heavily rely on cloud infrastructure, they accept the associated risk. The BedRock Hypervisor minimizes this risk, ensuring the confidentiality, integrity, and availability of all information stored on a government cloud infrastructure. Applications can run securely, even on untrusted or compromised cloud infrastructure, ensuring maximum objective security. Our formally verified, trusted computing base allows for innovation even while under attack.
Virtualization in the cloud and on the edge can reduce operational expenses and make information sharing easier. It also puts applications at risk of exposure if not executed with care. The BedRock Hypervisor enables organizations to run critical applications and securely store data on the cloud, even if cyber-attacks are attempted.
Protecting Critical Systems From Edge to Cloud
Most cyber-attacks are detected when an adversary has already achieved its mission and objectives. The challenge is then determining the extent of the damage and what mitigation, restoration, and future preventative measures need to be put in place. The BedRock Trusted Compute Base and Active Security™ focus is on prevention and mitigation rather than detection and response. This is a commercially deployable framework that supports ARMv8 and X86 in Commercial and Government as well as IT and OT. This framework enhances achieving the principals of Zero Trust when applied on edge devices and to cloud infrastructure as well.
Virtualize to Isolate, Secure, and SWaP-C
Unlike other virtualization architectures where sharing resources is an essential element of the value proposition to optimize performance within a software defined environment, BedRock virtualizes to isolate, secure, protect, and formally guarantees isolation (does not share resources) in our capabilities based architecture across VM/VMM’s. We also enable the definition of specific relationships between VM’s based on policy to manage secure access to drivers or other VM’s where sharing information across domains are required. This modularity and composability provide the systems architects multiple degrees of freedom in using trusted virtualization:
- To protect critical security/safety functions using Active Security™ to enforce least functionality against both known and unknown vulnerabilities
- Reduce or consolidate hardware footprint – Size, Weight, Power, and Cost (SWaP-C) – while maintaining current software (inclusive of mixed criticality systems) and utilizing active security to mitigate applications vulnerability
- Enhance capabilities required for integration in both modernization and greenfield initiatives to meet Zero Trust, Cyber Resilience, and Total Life Cycle Cost Reduction Objectives.
- Establish a lower cost and more flexible path for modernization and future updates during the product life cycle.
In summary, it is imperative in today’s environment that a product provide multiple capabilities (or dimensions of value..) to enhance the customers value proposition. In the case of BedRock, we find that depending on the application our customers typically prioritize these differently – with one providing the pull while bringing the others along.
Trusted Integration Framework that Enables Secure Modernization
In today’s environment we are finding that the need for interoperability and modernization are driving increasing complexity and abstraction layers to support legacy environments (i.e. Greenfield vs Brownfield). This increases the attack surface making it even more challenging for traditional monitoring and detection even with AI and ML to assist in discovering the “unknown unknowns”. Furthermore, in many critical systems there are significant costs associated with updating current software and hardware due to recertification and testing. It is highly desirable to provide reference unified architectures and policies that can be leveraged across multiple platforms to reduce life cycle cost and provide future paths for supporting the product life cycle (i.e. upgrades et al). BedRock provides a trusted computing base integration framework that accomplishes these objectives – some examples:
- Can be used as a trusted integration framework leveraging virtualization to reduce abstraction layers, provide integration capabilities within the trusted environment, and provide a path to leverage virtualization in Planned Product Performance and Upgrade Initiatives.
- Run current and legacy applications, OS, data, protocols, …. environments using the principle of least functionality to both secure and enable modernization in parallel on the same processor platform
- Isolation of devices from networks for enhancing zero trust in preventing network attack vectors from migrating across devices compromising sensitive data or operations
Zero Trust - Moving Beyond Least Privilege to Least Functionality
The cybersecurity posture and trustworthiness of the computational platform of a device is a critical attribute of the Zero Trust architecture. Computations whether in the cloud or at an edge device must be executed at a hardware platform that is secure and trusted. An inherent flaw in our systems is the general purpose compute design and interoperability philosophy that accompanies most all commercial and non commercial implementations. Dependent on the specific application or component – the degree may be more or less specialized but vendors attempt to service the broadest market. Adversaries take advantage of the additional available functionality within these to navigate around security and exploit attacks against the device and architecture it is connected to.
To constrain functionality of existing systems is not possible without a tool like BedRock. BedRock’s trusted virtualization and active security enables constraining functionality to that which is necessary to provide the system access only to the functions required. In zero trust we refer to this as implementing the concept of least functionality….. similar to the philosophy of least privilege. By leveraging the capabilities of virtualize to isolate, secure, and protect by enabling composability and modularity within a capabilities based model using BedRock’s Active Security(™) to constrain (i.e. allow/deny) in this way eliminates a significant attack surface without having to rewrite applications and operating systems….. enforcing the zero trust concept of least functionality.
We Provide Solutions
The growing use of cloud environments and connected devices within governments worldwide necessitates that departments and agencies update their cybersecurity risk management policies. BedRock Systems provides state-of-the-art security and top-level safety for sensitive data, protecting cities, countries, and the people within them.
