# An Evaluation of the Security of Bare Machine Computing (BMC) Systems against Cybersecurity Attacks
Most end-user applications run on top of some operating system (OS) [6], and all computing systems run on some processor architecture such as Intel, AMD, and RISC [7]. Many processor chips exist [8] with multiple cores and other features. There are also many vendors [9] for software, hardware, and other components. Furthermore, there are a variety of cybersecurity methodologies, computer architectures, and implementations [10]. There is heterogeneity and redundancy in the above dimensions and rapid obsolescence. The ever-changing hardware, software, and related products contribute to increased complexity and related cybersecurity issues [3] in computer and information systems, resulting in a waste of resources and human skills, recurring costs, dumping of hardware, and reinventions in many dimensions. The attributes discussed here are mainly due to obsoleting products before their life span [4]. Surprisingly, many other aspects of obsolescence, including planned obsolescence [5, 6, 7], focus on sustained revenues and profits for the industry. Microprocessor and OS obsolescence are the main contributors to fast changes in computing and information systems. Cybersecurity vulnerabilities are rooted in many dimensions and layers. Given the multidimensional nature of cybersecurity, it is possible to reduce this space by eliminating some of the dimensions. We present a radical solution that eliminates the OS. When the OS is eliminated, computing is based on the bare machine computing (BMC) paradigm, and applications become BMC applications, as discussed in Section 3 below. This paradigm makes computing devices bare and is inherently secure by design. Some background on cyberattacks is necessary before discussing our methods to evaluate the BMC paradigm. We have chosen 22 cyberattacks to investigate in our study. In general, an attack always uses one or more vulnerabilities to create an attack. For example, a buffer overflow vulnerability can be used to craft many different types of attacks. Similarly, SQL injection may be used to attack a database system. 1. Buffer Overflow: A buffer overflow is a condition that exists when a program can put more data in the buffer than its allocated size. According to [8], \"buffer overflow attacks played a major role in the propagation of malicious worms from machine to machine\". 2. Phishing: This is one of the most used attacks in the cybersecurity world. Social engineering techniques are mostly used in phishing attacks [9]. Attackers persuade or lure users to share private information that can be used later to exploit their personal accounts, such as banking, credit cards, social security information, and personal assets. They can also use this information to damage their computer system. Figure 1: Ten dimensions of cybersecurity space. Ransomware: Ransomware is malware that captures the victim's data or device and renders it unusable till some ransom amount is paid. There are two types of ransomwares: locker and cryptographic [10]. Locker ransomware is intended to lock computer access to users or delete files. Cryptographic ransomware encrypts files with hacker keys and demands a ransom to recover files. The main goal of ransomware is to extort money from victims. 4. Denial of Service (DoS): DoS [11] is an attack that can flood a victim's server with a variety of packets, such as UDP, SYN, HTTP, and ICMP. The goal is to slow down or crash the machine completely. The same attack can be carried out on a server using distributed systems known as distributed denial of service (DDoS) [11] to accomplish a larger and faster attack on a victim. 5. Man in the Middle (MitM): MitM [12] involves an attacker successfully inserting themselves between two communicating parties. The attack can be conducted within the same network or on the Internet. There are a variety of ways to conduct a MITM attack using protocols such as ARP, DNS, ICMP, DHCP, SSL/TLS, and BGP. 6. Password: This is the most common and obvious way to attack computer systems or smartphones.