Look at the device this article is really about: an ordinary wireless router. Unremarkable, cheap, and plugged in somewhere you rarely notice.
That router is now an essential part of the Internet of Things ecosystem, a network that already includes more than 12 billion devices. Among them are not only personal gadgets, but industrial and medical equipment, Smart City systems, and much more.
Because the market demands that IoT devices be as cheap as possible, they have become extremely vulnerable to cyber threats, far more vulnerable than, say, your laptop. And by hacking corporate wireless routers, an attacker can break into almost anywhere: the computers of accountants, the mail server holding executive correspondence, or the cloud storage of software developers.
Now imagine a device like this, an IoT gateway, installed at an industrial enterprise and communicating with systems that directly control the production process. What happens when it is hacked? And how do you keep the cost of protection at an acceptable level?
There is an answer to these questions: a different approach to protecting IT systems, built around the idea of innate, architectural protection. It is the same reasoning that shapes Boot2Desk.
When data stops being the only thing at stake
As IoT systems become more sophisticated and more widespread, the cyber threats aimed at them spread with them. Today it is no longer only a matter of stealing or compromising data. It is a matter of the safety of people’s lives.
A steel mill, June 2022
Hackers attacked a unit controlling the supply of hot metal to the conveyor at a steel mill. The unit failed and caused a severe fire.
Faced with trends like these, it became clear that existing approaches are not enough. This is how the concept of a self-defending, resilient-by-design system appeared.
The camera shutter idea
How do you protect your laptop camera from unauthorized recording? One option is to detect and block every kind of spyware, but attackers keep inventing new, more sophisticated methods, and you have to keep up with each one in time.
Systems built this way follow the same logic. The approach starts from the assumption that in the modern world, everything that can be hacked will be hacked. So instead of chasing every known vulnerability, it shifts the paradigm: build the architecture so that exploiting vulnerabilities, which always exist, becomes very, very difficult. Difficult enough that spreading an attack and hacking the system is simply not cost-effective.
The result is a system with built-in protection from both known and entirely new types of cyber attack. For the same amount of money, you get a system with far better security.
The four principles
How is it done? This approach rests on four principles.
- First, isolation Every component of the system is separated from the others using security domains. If one component is compromised, the attacker cannot reach the others or spread the attack to them. This lowers not only cyber risk but also development cost, because there is no need to exhaustively verify every third-party component.
- Second, interaction control All interactions between security domains are governed by a specific module, a security monitor. Like a guard at a private party, it checks whether each interaction is on the whitelist, and if it is not, it does not let it through. This dramatically reduces what an attacker can do, because every unknown interaction is denied by default.
- Third, minimalism Each component, especially the critical ones, should contain as few lines of code as possible, because less code means a smaller attack surface and fewer vulnerabilities. This becomes possible with a microkernel operating system, which contains hundreds of times fewer lines of code than a traditional monolithic kernel, and therefore hundreds of times fewer errors. Whole classes of cyber attack simply become impossible.
- Fourth, a security development process When building a system like this, developers think about security across the entire life cycle, starting from the earliest stages, before the architecture is even laid down. First, they formulate the specific tasks the system must perform under any circumstances, even under attack. Then the system is designed so that this is guaranteed.
This is also cost-effective, because the cost of fixing a vulnerability grows as you move through the development life cycle. It is cheaper to lay security into the architecture than to patch it in later.
What can be built this way
In principle, almost anything, from autonomous cars to industrial systems. Today the focus is mostly on specialized systems with moderate functionality and low-to-moderate security requirements: IoT and industrial IoT devices, Smart City systems, and specialized mobile devices.
There are already several products designed this way. One example is an IoT gateway that securely merges the OT environment (field devices, sensors, actuators, machines) with the IT environment of business systems. Another is a hardened thin client: the secure last mile in virtual desktop infrastructure. Read more about the thin client problem.
Where Boot2Desk fits
Boot2Desk is a practical expression of these same principles: a temporary, security-focused desktop built on Debian 13, designed so that an intruder has as little room to work with as possible. Applied to the endpoint, it protects the one thing that matters most: a secure connection to a remote server. Because the security lives in the architecture, even compromising one component does not automatically violate the system’s critical properties. Read the full Boot2Desk article.
The four principles are not theory here. They are visible in the construction:
- Isolation Applications such as Firefox ESR and Remmina run inside Firejail sandboxes, so a compromised program cannot freely reach its neighbors.
- Interaction control AppArmor limits which resources each process may touch, seccomp filters the system calls it may make, and nftables enforces a deny-by-default firewall over the network.
- Minimalism The system runs entirely from RAM, keeps no persistent storage, and reaches no internal drives, so there is far less code and state to attack.
- A security development process The system is built locally from public Debian sources, so the security rules are decided and reviewable before anything is assembled.
The result is a device that can be expected to keep doing its job even when it is actively targeted, and that starts over from a clean state on the next boot.
A more secure future, by design
In general, this way of thinking lets us look at the security of technological products in a brand-new light. It makes it possible to build devices that are guaranteed to perform their tasks even if they are hit by a cyber attack.
No single measure makes a system bulletproof. But by cutting the number of possible attack paths and limiting the consequences of an intrusion, we make it far harder for an attacker to succeed, and the future we are so actively moving into becomes a little more secure and a little safer.
Boot2Desk is one small step in that direction: a computing environment built to do its job, leave as little behind as possible, and begin again from clean.