White Paper

WHITE PAPER Buy vs Build: Deploying a Cyber Survivable Operating Environment mrcy.com 3 Figure 1: RelianceOne OE Concept of Operations Lifecycle TOGETHER THE RELIANCEONE OE AND SUSTAINMENT PLATFORM: The number of embedded OS and devices in use worldwide has grown rapidly. Grand View Research estimates the global embedded system market was $112.3 billion in 2024 and will reach $169.1 billion by 2030. The hardware in these devices and systems—which can perform without needing cloud computing—processes data and delivers low-latency decision-making and operations. With billions of such devices, including consumer devices to those responsible for critical infrastructure and defense operations, OS-level cyber resilience is critical. Examples of embedded devices include: ▪ Constrain an adversary who has already gained access and is using authorized executables, configuration files, and interpreters for unauthorized purposes; ▪ Prioritize vulnerability remediation on a hardened platform, where published Common Vulnerabilities and Exposures (CVE) severity scores assume an unprotected Linux baseline and may therefore overstate the real risk to the system; ▪ Restore a mission critical edge system to a trusted configuration quickly and provably after an engagement, without creating a vulnerable rollback path an adversary can abuse; and ▪ Demonstrate survivability and facilitate the assessment of specific mitigations with objective, repeatable evidence rather than design assertions. As Figure 1 shows, the RelianceOne OE carries a program through the full concept of operations lifecycle: integrate and harden the stack, withstand an active intrusion while mission functions continue to execute, recover precisely to a known-good configuration, then assess and sustain the platform using vulnerability intelligence that accounts for RelianceOne mitigations. Today, edge platforms borrow cybersecurity requirements from enterprise security concepts. Requests for proposal call for Security Technical Implementation Guides (STIGs), or for an all-consuming effort to identify and implement the controls dictated by the Risk Management Framework (RMF). That approach carries a hidden tax – the technical security controls described in those documents require substantial implementation and sustainment effort. Mandatory access control, kernel hardening, at-rest encryption, integrity verification, and tamper protection; each require dedicated engineering hours, access to scarce security subject matter experts, and a schedule that was very likely not built to absorb this custom hardening work. Moreover, with a cybersecurity plan based on STIGs or RMF, these activities stand in the way of approval to field and operate critical defense systems. The result is a baseline that is compliant only on paper, expensive to sustain, and still built on the assumption that the adversary can be kept out.

• Cover