WHITE PAPER
Buy vs Build: Deploying a Cyber Survivable Operating Environment
mrcy.com 2 mrcy.com 2
Military combat systems must fight through cyberattacks, not merely observe and report on
known vulnerabilities and signs of active intrusion. Adversaries with nation-state resources
target avionics, mission computers, and sensors, and they have every incentive to take and
hold a position deep inside those systems before and during an engagement rather than
simply publish a vulnerability announcement. Adding to the challenge, the software deployed
with combat systems has grown to enable malicious activity, by including bloated open-
source components, end-of-life software and library dependencies, and critical applications
deployed unprotected. This posture all but guarantees that, once access is obtained, affecting
operations is simple. Finally, the security methodologies and tools commonly deployed across
the Department of War (DoW) like the Risk Management Framework (RMF) were created with
a different problem in mind, namely, to detect and respond with the assumption an analyst, a
network, and the time to recover are all available. Unfortunately, none of these are guaranteed
in a contested engagement. What is missing is an operating environment that can be deployed
at scale across programs and shown, with evidence rather than assertion, to keep the mission
running despite an adversary gaining a foothold.
Mercury Systems is pairing the RelianceOne™ Operating Environment (RelianceOne OE), a
pre-integrated, cyber-survivable operating environment for mission critical edge systems,
with a survivability sustainment platform. The RelianceOne OE combines Linux (enterprise or
embedded distributions) with Mercury's fielded RelianceOne for Linux protections, so that a
program of record receives an operating system its engineers already know how to use, with
cyber survivability built in rather than bolted on. The sustainment platform complements the
RelianceOne OE and includes an augmented CVE analysis methodology, configuration control
playbooks, and the threat models, requirements, and test harness that make survivability
measurable. bypass security controls and cause operational downtime; gain entry to and
hobble larger or adjacent systems; steal data; disrupt supply chains; and enable attacks that
can damage or destroy physical equipment.
