Startup Bromium Seeks to Improve Cloud Security

Security in the cloud is on the minds of many IT administrators these days. While some fears of the cloud are unfounded, there are some real concerns that need to be addressed. Yet despite concerns about data in public clouds, former Citrix CTO Simon Crosby contends that cloud security should begin at the desktop.

To address this issue, Crosby (who also co-founded XenSource) has partnered up with his XenSource partner Ian Pratt and Gaurav Banga, who was formerly the CTO of BIOS maker Phoenix Technologies, to launch Bromium, a new company focused on cloud security. While the exact details of what types of products Bromium will produce is still unclear, Crosby did reveal some of the thinking behind creation of his startup in a telephone interview earlier today.

Bromium's Simon Crosby

Crosby believes that virtualization can be a powerful tool for cloud and overall IT infrastructure security, and hinted that Bromium's efforts would be in this direction. In a farewell post on his Citrix blog earlier this year, Crosby stressed that approach:

During our interview Crosby also argued that traditional attempts at securing the desktop had failed, and pointed to the flood of cyberattacks the industry has seen so far this year, ranging from the successful spearphising attack against RSA to the exploits of Anonymous and Lulzsec. "Everyone now understands that the traditional way of securing endpoints using blacklisting and all the antivirus stuff is done," Crosby said. "It doesn't work. Whitelisting is ok, but it doesn't go far enough." Crosby then point to Microsoft Outlook as a prime example of an application that is whitelisted, but can still be a method to distribute malware via infected emails.

Crosby suggested that virtualization could be part of the answer, and that when we look back on the progress of virtualization years from now, we'll see that "one of the primary values of hardware virtualization was security." McAfee's DeepSAFE technology utilizes a type 1 hypervisor to improve system security at close to the hardware level, and Crosby pointed to some of the work that he and his team did with Citrix XenClient also made strides in leveraging virtualization for its security benefits.

More details about Bromium's products should be revealed in the first quarter of 2012, so we'll be check back with Bromium in a few months to see what Crosby and Bromium have in the works.

What are your thoughts on Bromium and cloud security? Let me know what you think by adding a comment to this blog post or starting up a conversation on Twitter.