Bromium Secure Platform 4.1

Malware remains a major threat across standalone systems, enterprises, and government environments, with attackers targeting everything from individual devices to entire networks. Early, file-based malware spread through exchanged software and removable media; comparable risks persist via USB sticks and portable drives. Email has become a primary propagation channel due to long-standing conceptual security weaknesses, while network worms can spread without user interaction by compromising exposed services on well-known TCP/UDP ports. End users still play a central role, as attackers exploit trust and inattention through poisoned high-traffic websites, convincing phishing links to fake sites, tampered applications, embedded executables, and malicious Office macros.

Ransomware has become especially prominent by encrypting user files and demanding anonymous ransom payments (commonly Bitcoin), often delivered through macro-enabled Office documents. The text emphasizes not paying ransoms because decryption is not guaranteed and payment incentivizes further crime; instead, isolated, regular backups are positioned as a core safeguard. Attackers have continued to innovate, using worm-like distribution and even legitimate software update mechanisms; Petya/NotPetya is described as ransomware-like malware intended to irretrievably destroy data.

Traditional antivirus began with signature-based detection and frequent updates, but polymorphic malware reduces the effectiveness of signatures alone. The document highlights Bromium’s endpoint approach: using virtualization to create disposable, one-time “hardware-enforced micro-VMs” that isolate risky tasks (browsing, opening unknown files) from the host OS. Separate micro-VMs can be created per browser tab or per Office/PDF instance, preserving forensic traces while self-remediating by terminating micro-VMs after use. The platform combines Secure Files, Secure Browsing, and Secure Monitoring, integrating with enterprise SOCs; it targets organizations (not consumers) and may require user awareness and training.

• Removable storage media such as USB sticks and portable hard disks can still spread file-based malware.
• Email has become the most important vector for the spread of computer viruses.
• Network worms can spread malware over networks without users opening files or email attachments.
• Worms traverse networks by compromising services exposed on well-known TCP or UDP ports that are not properly protected.
• Ransomware encrypts user files and demands an anonymous ransom payment for decryption keys, usually in Bitcoin.
• Petya/NotPetya mimics ransomware but is intended to irretrievably destroy data.
• Early antivirus products detected malware using vendor-collected samples and signature files, with signature updates delivered several times per day.
• Bromium was founded in 2010 and is based in Cupertino, California, with product development in Cambridge, UK.
• Bromium made its endpoint protection products generally available for mainstream enterprises starting in 2017.
• The Bromium platform isolates a separate micro-VM for each browser tab in its secure browsing mode.

• “Malware today is more diverse than ever”
• “Network worms are specialized programs that can spread malware over networks without users having to open files or email attachments.”
• “Unfortunately, it continues to be the case that reluctant and overly trustful users can be encouraged to interact with malware to easily infect their workstations or entire networks.”
• “Ransomware is a special subspecies of malware that encrypts user files and instructs the user to anonymously pay the malware author a ransom for the decryption keys”
• “the best advice for end users and companies here can only be not to pay the ransom”
• “The perpetrators are innovative by using the tried and tested distribution technology of worms or even the update mechanism of legitimate software for ransomware.”
• “Malware has become much more sophisticated and often uses polymorphic techniques to change its appearance”
• “temporary virtual hardware environments are created whose goal is to isolate and analyze endpoint computer threats”
• “This approach protects organizations from OS and application level vulnerabilities, especially kernel exploits, by isolating individual tasks into what Bromium calls ‘hardware-enforced micro-VMs’.”
• “Although the Bromium approach contains a central component for e.g. configuration, control and policy definition, it perfectly fits into today’s perimeterless networking and security paradigms.”