Trust Starts at the Silicon

Our adversaries are in our networks, exfiltrating our data, and exploiting our users. It is imperative to ensure that malicious actors cannot roam freely through our networks, threatening our ability to deliver maximum support to the warfighter. The rapid growth of these offensive threats emphasizes the need to adapt and significantly improve our deterrence strategies and cybersecurity implementations. Our IT systems must possess the ability to withstand cyber-attacks while retaining mission capability – they must be resilient.  Defending our networks with ever-more sophisticated perimeter defenses is no longer sufficient for achieving cyber resiliency. 

‍

We must establish defendable networks and Zero Trust architectures to protect our data and systems from malicious actors and sophisticated cyber attacks, such as side-channel attacks, ransomware attacks, zero-day exploits, and advanced persistent threats. Traditional hypervisors share hardware resources between VMs that can open workloads up to side-channel attacks (think Spectre, Meltdown). Attackers are moving lower in the stack to target BIOS, Firmware, and Hardware to avoid detection. Spectre and Meltdown are two famous examples of side-channel attacks that happened in 2018 representing a new class of hardware vulnerabilities affecting almost all modern CPUs, allowing an attacker to extract secrets from an application that is co-hosted on the same CPU as an  attacker application. 

‍

The only defense against these attacks is to apply patches or use stand-alone, bare-metal machines. The most secure way to defend against side-channel attacks is to not share hardware with other VMs, something that would make most traditional virtualization impossible to do as it’s a fundamental architectural design to share hardware between VMs in existing virtualization. Traditional virtualization timeshares the physical hardware between VMs where speculative execution can be run against a CPU and may reveal private data to attackers.

Metalvisor operates at the lowest level of the system to set up security and cryptography controls at boot, launching virtualized workloads from the firmware layer beneath the Operating System (OS) to ensure a secure foundation for all compute workloads.  By implementing security at this level, we are able to restrict threats and adversaries that would otherwise be able to bypass traditional security measures. We are securing the edge against low-level and hardware-based vulnerabilities using heuristic analysis to stop zero-day exploits and other cyber threats.  

‍

Metalvisor provides organizations the ability to have a cyber-resilient security posture  to microsegment commercially available multicore processors in compliance with NIST 800-207 for Zero Trust and includes the  following Zero Trust capabilities:

• Segmentation and Hardware-based Isolation to secure edge workloads against persistent, sophisticated cyber attacks
• Multi-Key Total Memory Encryption protects data in all forms (at-rest, in-transit, and end use).
• Active Response Capability (ARC) built-in to detect and respond to potential threats in real-time. 
• Immutable Workloads and Cryptographic Signing of Workloads to verify authenticity and integrity of workloads before execution.