VSentry is deployed like an application and takes control of some parts of the machine hardware such as CPU and memory, but not the entire machine as would a bare-metal hypervisor. "It's as bare metal as it needs to be, but doesn't need to be in control of the entire machine," Banga says. MicroVM access to memory and cache must go through the Microvisor, for example. But trusted applications have direct access to system resources without going through VSentry.
This access to the hardware is accomplished via virtualization support for virtualization found in certain x86 processors. Devices built on ARM processors can't be served by VSentry until ARM Version 7 comes out sometime next year, Banga says. It will include the necessary support for virtualization.
Because VSentry is tied directly to the hardware, its Microvisor is very secure, says Edward Haletky, president and CEO of The Virtualization Practice. "You'd have to break the hardware," he says, and that is very difficult due to the chips' sensitivity. "If you attacked it, you'd literally fry it."
Businesses should look at VSentry as part of a defense-in-depth strategy, he says, but home users might consider it as their only defense if they start off with a clean machine, Haletky says.
The software is suited to mobile workers who use hotel networks and other publicly accessible networks with unknown security. Users could access a public access point via one microVM and VPN into a corporate network with another, preventing attacks from affecting the laptop being used, he says.
The software incorporates a capability called Live Attack Visualization and Analysis (LAVA), which can view and record any attacks that unfold within a microVM, Banga says. This information can be used to answer requirements of regulators and auditors about what threats a business faced and how it dealt with them.
The initial version of VSentry has some limitations. It only works on Windows 7 machines, but versions for Windows 8 and Mac OSX are in the works, Banga says, as are Android versions suitable for smartphones and tablets.
The software assumes it is running on a clean machine and has no provision for dealing with one that is already infected, but that will be addressed in future versions, he says. If the machine is not clean or if the user gains rights to alter it, "All bets are off," he says.
So far VSentry can't run on virtual desktops, but later versions will. It also can't run on traditional virtual machines, but Banga regards that as a niche case that doesn't come up much in corporate settings.
Management of VSentry software can be carried out via Microsoft System Center and Active Directory and any other management platform that can work on top of Active Directory. Policies about what is trusted and what is not can be pushed via Active Directory. Bromium is working on interoperability with HP's ArcSight management and McAfee ePolicy Orchestrator.
Banga says businesses will be able to lift restrictions on what Web content workers access, potentially improving productivity by reaching sites such as social networks that might have been banned because they were too high a security risk. It gets rid of the tradeoff businesses have to make between security and functionality, he says.
The company says it has 43 customers, none of whom were available to talk about it, Banga says.
Tim Greene covers Microsoft for Network World and writes the Mostly Microsoft blog. Reach him at email@example.com and follow him on Twitter @Tim_Greene.
Read more about wide area network in Network World's Wide Area Network section.