Securing the endpoint with Micro-Virtualization

With an attack surface of many tens of millions of lines of code, commodity operating systems such as Windows and OS X pose an easy target for hackers. Users may be duped into exposing their systems to such attacks through a variety of means such as a malicious web links, poisoned email attachments or rogue USB sticks, though increasingly attackers are using techniques such as malicious advertisements or "watering hole" attacks that compromise systems without the user even having to click on anything bad. Existing security products do a poor job of defending against such attacks and are easily evaded by zero-day or polymorphic malware. This talk introduces an new approach called micro-virtualization, in which a separate virtual machine OS instance is created for each individual task that a user performs. Hence each web site, each document, each spreadsheet etc opens in its own isolated micro-VM. Hardware virtualization capabilities of modern CPUs can be used to achieved robust isolation between micro-VMs with excellent performance and an unchanged user experience. Hence micro-virtualization provides a practical implementation of the principal of least privilege that operates below the client OS, implemented using a small, hardened code base that is orders of magnitude harder to attack.