You may have heard that Bromium is one of the top 5 cloud companies to watch in cloud security and was named startup of the year, but we’ve generally been trying to keep a low profile – mostly because what we are doing is difficult technically, and we wanted to make substantial progress before talking about it.
Bromium is developing a second-generation virtualization technology that offers profound benefits in the trustworthiness, security and manageability of computer systems. [“First-gen virtualization” includes the well-established use cases with which you are familiar. “Second-gen” includes these and substantially extends the value of virtualization.]
The Bromium system architecture is very different from anything available today. So much so that simply describing the technology would not be particularly useful – it needs to be set in the context of real world use cases and value propositions. So this and my next few blogs will set the stage for the forthcoming Bromium full monty.
It is important to clarify that Bromium is not attempting to add security to today’s clouds or virtual infrastructure deployments. We are developing a software system that has the potential to make any computer system (client or cloud) secure by design. Our goal is to transform the trustworthiness and security of computer systems and thereby enable enterprises to embrace the key trends affecting IT: consumerization, work-shifting, device diversity, and cloud computing.
We use hardware features for virtualization and security to deliver a huge leap forward in systems architecture, by tackling a “grand problem” – Trustworthy Computing. The Committee on Information Systems Trustworthiness’ publication, Trust in Cyberspace, defines such a system as one which
“…does what people expect it to do – and not something else – despite environmental disruption, human user, and operator errors, and attacks by hostile parties. Design and implementation errors must be avoided, eliminated, or somehow tolerated. It is not sufficient to address only some of these dimensions, nor is it sufficient simply to assemble components that are themselves trustworthy. Trustworthiness is holistic and multi-dimensional.”
This is a challenging goal, and one which it is probably impossible to achieve in practice, but we are confident that we can deliver an improvement of many orders of magnitude by comparison with current systems. And unlike most vendors, it is our goal to declare our limitations up front, rather than making claims that require customers to take a leap of faith.Our first product will be enterprise client focused, though the technology has broad applicability. Why clients? We are witnessing explosive growth in public cloud services and applications. Combined with the incredible adoption of mobile device form factors this has led to a profusion of new applications and challenges for IT: Whose device is it? Where is it? Who chose the application? Is the user authorized to access data or applications from it? What network is it on? Can enterprise data be secure in a world of empowered users? (Lest you’re inclined to scoff, have you ever used your PC in a hotel room?)
It is depressing to see IT leaders so focused on private versus public clouds – for so-called “security reasons” – yet they appear blissfully unaware that every single enterprise access point – PC, mobile or virtual desktop/app – offers the bad guys a direct route into the heart of the enterprise.
While trustworthy computing is a laudable goal on its own, our architecture is the result of a need to solve IT challenges at a time of profound change. IT is charged with compliance and security at a time when users – as consumers – are dictating the future. Personal usage, device and application choices, and the growth of employee mobility raise concerns about identity management, the security of data and access, the cost of support, issues of compliance, application compatibility and much more. From the user’s perspective “What matters is me!” but IT has no choice but to respond: “Users don’t get to choose!”.
It is impossible to empower the user without dramatically increasing risk to the enterprise. It’s equivalent to letting the bad guys in.
We need a radically new approach to securing access to enterprise applications and data, starting with PCs and mobile devices, but including hosted and virtualized access (RDS, VDI). We need to transform IT practice for endpoint security just as we needed a new approach for data center management before server virtualization catalyzed IT’s metamorphosis from dull cost center to an agile, service-centric, strategic business capacity. In the ensuing change, silo-ed work practices and legacy tools were swept aside by an integrated, powerful, automated virtual infrastructure management framework.
The desktop revolution calls for a profound change in the trustworthiness of our infrastructure. We need systems that are inherently trustworthy – by design. If such a thing already existed, then the mess of VDI, Patch Management, Data Loss Protection, End Point Security and Identity and Access Management practices would not exist. The infrastructure would shrug off attacks, protect enterprise assets at all times, and guarantee the privacy and confidentiality of the user. And we’d save about $10BN on useless software per year. That would be real progress.
So, I’d like to invite you to join me on a quest for the desktop Holy Grail. We aim to deliver a thing of beauty that is well matched to our human nature, that is affordable, reliable and secure by design, that empowers users and democratizes IT while preserving control and compliance.
Our quest will result in an architecture that can make trustworthy computing a reality, today.
No comments:
Post a Comment