# Will Zero Vulnerability Computing (ZVC) Ever Be Possible? Testing the Hypothesis
## 3 State-of-the-Art
### Technologies for Secure Execution Environments  
To cope up with the ever-increasing demand in hardware and provide solutions to the exploitation of vulnerabilities in program execution, libraries, and the operating system APIs, different kinds of architectures such as sandboxes, virtual machines, and containerized application systems have emerged (Figure 3).  
_Sandboxing_ was the first practice to establish the concept of running code in a safe, isolated environment that mimics end-user OS APIs. Sandboxes run as software in the application layer of existing OSs and execute potentially dangerous system calls inside a controlled environment. Sandboxes are inefficient in deploying complicated security policies, do not scale, and cannot protect the OS from various existing monitor-bypassing attacks.  
_Virtual machines (VMs)_ are the typical building blocks for cloud infrastructures to gain higher hardware resource utilization while preserving execution isolation among different computing instances [33]. A host OS is isolated through a hypervisor engine, and guest OSs are run in a protected environment. Execution within a guest OS only affects the guest OS API and its underlying software without ever reaching the host OS and its infrastructure. Still, from an execution perspective, having a dedicated OS for each VM and the full set of underlying software suggests that the attack surface and relevant security aspects for the VMs themselves do not differ from that of physical machines [34]. On top of that, various attacks exist that can escape the isolated environment and attack the host OS by leveraging the abundant resources found within the guest OS of a VM [35].  
_Containerized applications_, such as Docker and Linux Containers (LXC), emerged as an alternative to VMs by providing a convenient way to deploy and isolate applications without installing a guest OS and relevant auxiliary software necessary in a VM. Since there is no guest OS virtualization in a container, the attack surface bound to each guest OS and its software services cannot be exploited. However, as containers share the same underlying host kernel, access to containers is not easily secured, and even though Docker isolates parts of the underlying host OS API from containerized software, this can be an issue for multi-tenant security [36].  
_Air gapping:_ Although sandboxing, VMs, and containerization provide a high level of protection, if the local area network is connected to the Internet, a motivated adversary will find a way to breach the network, evade security mechanisms, access sensitive data, and transfer them outside to the attacker [37]. In order to provide protection from such breaches, organizations often store their sensitive data on air-gapped networks. In this approach, any type of physical or logical connection between the local network and the Internet is strictly banned [38]. Air-gapped networks are widely used in military and defense systems [39], critical infrastructure, the finance sector, and other industries [38]. Two famous examples of air-gapped networks are the NSANet and the Joint Worldwide Intelligence Communications System (JWICS), classified (top secret) networks belonging to the United States' Defense Intelligence Agency. Even air-gapped computers caged within an all-metal Faraday cage can be breached as demonstrated by Guri et al. deploying ODINI  
Figure 3: State-of-the-art cybersecurity approaches compared with ZVC’s zero attack surface approach.  
malware that uses magnetic waves for data transfer [40]. Besides these major cybersecurity approaches, there are several authentication-focused piecemeal protocols such as secure elements, secure tokens, hardware security, trusted platform modules, etc., but none of them has the potential to achieve zero vulnerability whether by completely obliterating the attack surface or creating in-computer offline storage.