Know what runs.
Control what it can do.

Finding flaws is outpacing the ability to fix them.

Growing codebases and automated attacks increase the burden on the people defending essential operations. Reduce the attack surface and constrain workload access at the foundation, giving your team less exposure to manage.

Less exposure. Clearer authority.

A smaller operating base reduces the attack surface. Least privilege limits each workload’s authority; workload isolation defines boundaries around data, services and resources. Keep useful computation within the access its job requires.

Establish the evidence.

A verifiable system gives your team evidence it can check. Functional verification establishes specified behaviour; cryptographic verification supports checks of identity and integrity.

Specified behaviour

Check which properties the covered components satisfy, under the stated operating assumptions.

Identity and integrity

Authenticate the system and check the integrity of its covered software and associated evidence.

Validation runs complement the evidence for the specified properties and deployment.

Make the security boundary explicit.

Review the verified properties, covered components and operating assumptions for your deployment, including hardware and application interfaces. Safety-critical or regulated applications require their own application-specific evaluation.