Does Government Need ‘Hardware-Separated’ Operating Systems?
We need a way to solve the “elevated privileges” dilemma.
Chuck Brooks is widely published on the subjects of emerging technologies, homeland security and cybersecurity. He served in government at the Department of Homeland Security as director of legislative affairs for the Science and Technology Directorate and for the late Sen. Arlen Specter as a senior adviser in tech- and security-related issues.
As Nextgov highlighted in a recent article, a poll by mobile security company Lookout revealed about 50 percent of federal employees surveyed said they check their work emails and download work documents on their personal devices.
Last year, an Associated Press study found about 50 percent of U.S. government cybersecurity incidents between 2010 and 2014 originated with the employee, at the endpoint.
The Office of Personnel Management breach was reportedly caused by the same type of endpoint phishing attack as an earlier, massive Anthem insurance company breach.
Unfortunately, the results are not surprising.
When you use a computer or smartphone for both work and personal activity, you have added significant risk your personal activity introduces malware that can access your business data and networks. This has effectively negated, or at least thrown into a quandary, plans for many agencies and companies for a secure "bring your own device,” or BYOD, program.
Employees continue to use personal devices for work, if only for the sake of convenience.
According to the Lookout survey: “People value their convenience very highly and usually will take the path of least resistance to accomplish their goals – risky or not. Employee education is important, but federal agencies need technology to back them up when education falls through.”
But as many of the government agencies and corporations which experienced breaches can attest, endpoint methods like firewalls, containers, virtualization and antivirus software cannot assure protection against malware introduced as a result of mixing-and-matching between work and personal activity on the same computing device.
Why? Because malware can still gain elevated privileges to access all device data, including the user’s authorizations to access work and network data.
Many successful attacks aimed at both government and industry have come through phishing and spear-phishing. In addition to the OPM and Anthem breaches, this includes Target, Home Depot, JPMorgan, Sony and other well-publicized attacks.
Meanwhile, we’ve also lost untold amounts of government data through organized through cybercrime like Operations Pawn Storm and Cleaver, and more recently, Angler.
Social media are also being targeted more and more: Facebook and YouTube were the sources of several large breaches last year. In the case of the most publicized enterprise breaches, such as Target and Home Depot, over 100 million records were exposed through a phishing attacks, and total enterprise costs exceeded $100 million.
Something more is needed to protect against the growing scourge of sophisticated phishing attacks: hardware-separated operating systems
We need a way to solve the “elevated privileges” dilemma. We need a way to make sure no matter what a federal employee does in his or her personal activity -- social media, emails, just browsing -- it won't be the origination of malware putting at risk sensitive government data or millions of personnel records.
One way to do this is through hardware-separated operating systems, or HSOS, in the same mobile device or computer. The HSOS creates two independent operating systems in the same computer. Each OS thus has its own kernel, RAM, storage and drivers. Neither OS cannot access the other.
What does this mean? It means no matter how sophisticated or effective malware is that accesses the computer in OS, even if it gains all of the user’s privileges for that OS, it cannot access the other OS. The other OS can be secured knowing that it is not vulnerable to anything transpiring in the other OS.
This is in effect a new “genre” of endpoint data separation security. The balance between security and usability is easier to strike, while at the same time a key vulnerability of other data separation methods -- malware from personal use that can access network data through elevated privileges -- is eliminated.
By providing effectively a separate personal device for the government or corporate employee, personal privacy is also assured, and the ultimate implementation of a BYOD program fostered.
As phishing attacks and data breaches continue to undermine secure government and commerce, the time is now for trying this new genre of cybersecurity.