Kernel-Level Security: HardenedVault Takes an Innovative Yet Practical Approach

On the Record

With cyber threats evolving rapidly, strengthening the Linux kernel's defences is becoming increasingly critical – but is the market ready?

January 14, 2024

Briefing Essentials

Company Name

HardenedVault

Briefing Theme

Introduction to kernel-level Linux security solution

Spokesperson

Ming Xu, CTO and Co-founder

FFD Analyst(s)

Tony Lock, Director of Engagement and Distinguished Analyst and Dale Vile, CEO & Distinguished Analyst

Key Words/Phrases

Linux security, kernel protection, zero-day defence, memory intrusion detection, exploit prevention, cloud security

Key Takeaways

1

HardenedVault has developed VED (Vault Exploits Defence), a kernel module providing proactive protection against both known and zero-day Linux kernel exploits through memory intrusion detection and anomaly monitoring.

2

The solution stands out for its relatively lightweight implementation and ease of deployment compared to alternatives requiring kernel patching or complex policy configurations, though distribution-level certificate acceptance remains a challenge.

3

While particularly relevant for organisations running critical Linux workloads or handling sensitive data, VED's value proposition extends to any enterprise concerned about kernel-level vulnerabilities that could bypass traditional security measures.

4

Current adoption appears limited mainly to organisations already highly aware of kernel-level security risks, suggesting significant market education is still needed around Linux kernel vulnerabilities and protections.

5

The technology shows promise but may need a major market catalyst - such as a high-profile kernel exploit incident or evolving regulatory requirements - to drive broader enterprise adoption beyond current security-conscious early adopters.

More on the Discussion

Our discussion with Xu revealed an interesting tension in the Linux security landscape. While Linux is often perceived as inherently secure, the reality is that kernel-level vulnerabilities represent a significant and often overlooked attack surface. HardenedVault's approach of using memory intrusion detection to identify abnormal code paths is technically elegant, offering protection against unknown threats without relying on signatures or prior knowledge of specific exploits. The solution's enterprise credibility is enhanced by the team's background, including Xu's experience at Symantec/Veritas, while its technical foundation in the Hardened Linux project speaks to its security-first design principles. The team sees particular potential in emerging use cases around IoT and AI computing workloads, where bare metal deployments demand particularly robust security. This focus on bare metal efficiency for AI workloads and HPC applications represents an interesting differentiation in their go-to-market strategy. The conversation highlighted how VED emerged from the open source Hardened Linux community, with a focus on securing Linux at the OS level and below. The company has made the solution accessible through multiple channels, including a plug-and-play kernel module for any distribution and pre-configured EC2 instances on AWS and Azure running on their hardened Linux platform. This flexibility in deployment options, combined with validation from major technology companies like Google Japan and NVIDIA, provides strong technical credibility. However, what stood out most was the fundamental challenge of market awareness and adoption. Many organisations, including major Linux distributors, don't fully grasp kernel-level security risks or see addressing them as a priority. As Xu noted during the briefing, the primary challenge isn't technical but educational - "how to get attention" when customers don't yet recognise why they need hardened Linux. This creates an interesting paradox where the solution may be ahead of mainstream market demand, despite addressing a genuine security need.

Real-World Sanity Check

The implementation challenges discussed during the briefing warrant careful consideration. While VED can be deployed as a kernel module, which should simplify adoption, the certificate acceptance issue with major distributions creates a practical hurdle. HardenedVault's workaround of providing pre-configured virtual machines through cloud marketplaces is pragmatic but may not satisfy all enterprise requirements. Certificate management aside, organisations need to realistically assess their security needs and capabilities. While VED is designed for minimal maintenance, proper implementation still requires some kernel-level security expertise. Additionally, while the performance impact is reportedly minimal, organisations with stringent performance requirements should verify this in their specific environments.

Notable Quotes

“Most of the problem was like, 'oh, I don't know. Nobody talked about this is an issue. Why should I bother?'"

- Ming Xu on market awareness challenges

"When you're talking about ‘declouding’, you need a much more secure version of the systems."

- Ming Xu on emerging use cases

"A lot of times, manufacturers give you a black box, which basically is unopened."

- Ming Xu on supply chain security

"The community itself is building all the building blocks."

- Ming Xu on open source collaboration

Bottom Line

HardenedVault's VED represents a technically sophisticated approach to a real but under appreciated security challenge. While the solution shows clear value for security-conscious organisations, broader market adoption likely depends on increased awareness of kernel-level security risks or external catalysts like regulatory changes or high-profile incidents. The technology is solid; the main challenge lies in market education and timing.

Click the button below to download the PDF version...