Bromium Protected App: to secure sensitive applications

Bromium is an editor who has democratized the idea of ​​process isolation by micro-virtualization, going so far as to seduce Microsoft, which relies more and more on Windows. To put it simply, the concept is to rely on a hypervisor to run a given process or application in a lightweight virtual machine on the workstation. If the application or process in question is deemed healthy, it’s about protecting it from attack by adding an abstraction layer  to the operating system. If it is suspect, or known as a common input vector, it is, in the same way, to prevent it from accessing the system, but this time to protect the system.

Nothing is 100% secure

With Protected App, Bromium assumes that it is impossible to be fully sure of security and that any solution will eventually be compromised by a technology or vulnerability still unknown.

Many security products focus on preventing compromise, while Protected App is based on the assumption that the intrusion has already occurred: for example, the network, the infrastructure, and its hosts are already compromised and hostile. No question, then, to imagine that there is, in the SI, an environment of trust, healthy and another where everything is potentially threatened. With Protected App, Bromium thus targets use cases where it is assumed that the host is already compromised (or might be compromised in the future).

In practice, the end user receives the application from the company owning the data and the network to which it will have access, in the form of an MSI package. Its installation results in the insertion of an extension in the UEFI ( Unified Extensible Firmware Interface ). It comes into effect after restarting the machine and the protected application appears in the Windows start menu. It runs locally, but the abstraction layer added by micro-virtualization makes inaccessible to a hacker keyboard entries or graphics displayed.

For the time being, Bromium uses the Protected App environment to isolate Remote Desktop Protocol / Independent Computing Architecture (RDC) clients . Future releases will focus on potentially rich Web applications and client applications.

The return of the bare metal customer hypervisor?

The concept does not fail to fire XenClient, the Type 1 client hypervisor  abandoned by Citrix at the end of 2015 . Because after installing a Protected App, it is a hypervisor that controls the machine, with one side a virtual machine for the operating system, and another, hardened, for the so-called protected application.

The Start menu item in the original operating system virtual machine is actually a client of the hidden virtual machine that is running the protected application. And it uses a separate memory and resources. It is disposable and non-persistent.

Basically, Bromium Protected App provides a way to access secure trusted networks from less secure networks, minimizing risk. With this new product, the publisher targets specific use cases, in the administration, or the legal and financial services, where employees are likely to use personal computers: it is to ensure that End-customer data is protected as it should.

But Bromium also sees use cases related to applications that deal locally with data that should not be transferable to others, such as in the medical field or call centers.

Thus, if with its initial offer, Bromium targeted the deemed safe environments from which it is necessary to access potentially risky environments, such as the Web, it aims the opposite: ensure the protection of data and applications sensitive devices used on systems whose security can not be guaranteed.

Leave a Comment