IARPA looks to reinvent the virtual desktop

The Intelligence Advanced Research Projects Activity isn’t content with the intelligence community’s current cloud-based user computing environments and is looking for a more secure virtual solution.

The IC’s Information Technology Enterprise program is currently migrating classified data to a private cloud, unclassified data to the public cloud and workloads to a virtual desktop infrastructure (VDI).

According to IARPA Program Manager Kerry Long, this shift is not only carrying over old threats to the new environment, it is creating new security risks. To reduce that exposure, IARPA wants to use role-based virtualization  -- a virtuous user environment, or a “VirtUE.”

As Long explained it, VirtUE would reimagine the interactive user computing environment, turning it into a more dynamic, secure sensor and defender without alienating users.

Currently, VDI isn’t capable of supporting the big data-based security analytics coming from users’ virtual workstations, Long said at FCW's Cloud Summit on Aug. 10.

Additionally, attackers can still travel through networks or user workstations, as VDIs aren’t designed to detect or resist threats of the cloud. In fact, VDIs don’t provide much more protection against external and internal threats than physical workstations did, and they introduce additional threats of malicious peer workloads and attacks through hypervisors or virtual machine management.

Current VDIs also use a shared memory pool and allow for too much flexibility, capability and data accessibility. For example, the IC ITE could have different agencies using the same physical server. If a member of one agency is running a workload in the same physical “box” as a member of another, the only thing separating each workload is a hypervisor.

“We have this huge layer we don’t understand currently…that now every one of our workloads depends upon,” Long said, referring to the hypervisor.

Most assume hypervisors are nearly impossible to breach, but Long said the Virtualized Environment Neglected Operations Manipulation, or VENOM, vulnerability has existed in hypervisor codebases since 2004, though was just made public last year. It allows attackers to gain access to the host system and all virtual machines running on that host.

With the VirtUE program, “we’re trying to create some sort of mechanism that we can put on these private and public clouds to give us more security -- a secure container that can run in the cloud and resist these threats and can be a better sensor for security data analytics,” Long said.

The individual “virtue” would run on a cloud provider’s virtualized infrastructure and stand up to external, internal, peer and hypervisor threat vectors on the cloud.  Each virtue functions as its own virtual environment with a specific risk profile to sense and respond to threat. They should be easy to build, modify and share among government, and include a dashboard-like interface so users can run several virtues at once.

Long said the idea of defining, limiting, controlling and transferring virtues was inspired by the Docker container concept. Containers allow users to build applications in parts, share them and easily add or remove capabilities, rather than creating one big platform.

Like applications, role-based virtues could be set up for a document editor, internal SharePoint user, Active Directory administrator, internal and external internet consumer and for corporate email user. A document editor virtue, for example, might allow a user to create, edit or print a Word document but not email it or access the internet.

However, because users could run multiple virtues, they could access the internet via a different virtue. This way, if one virtue is attacked, the entire virtual machine environment wouldn’t be affected.

Conceptually, it’s an approach similar to what Authentic8, a provider of web browser security solutions, took with its Silo browser tool. In order to manage capability and data access, Silo allows users to browse the web through a “one-time-use virtual environment that can be thrown away when the session is over,” the company’s CEO Scott Petry told GCN.

Ultimately IAPRA wants to develop an infrastructure to deploy, operate and manage virtues and their dynamic analytics within a commercial cloud for intelligence agencies; Long said money has already been earmarked for that purpose.  For now, though, the goal is simply to build the environment, and "getting creative people to think how it would work," he said. 

The resulting code will be open source, Long added.

IARPA will release a broad agency announcement for VirtUE in September. It must run on an Amazon Web Services hypervisor -- AWS is the intelligence community's cloud service provider of choice, thanks to the $600 million private cloud contract inked by the CIA in 2013 --  and the user interface must be as responsive and functional as the IC’s current desktop VDI environment. 

Other than that, Long said, IARPA is open to most any approach -- so long as it doesn't replicate the virtual environment already in place.