# An Evaluation of the Security of Bare Machine Computing (BMC) Systems against Cybersecurity Attacks
## 5 Cyberattacks and Analysis  
An attack can have many stages, such as reconnaissance, weaponization, delivery, exploitation, installation, command, and control (C2), and actions on objectives [94]. An attacker may select the stages in their attack methodology based on suitability for their execution plan. Each cyberattack can be traced to one or more root causes in an information system: hardware, software, firmware, OS, protocols, layers, complexity, programming language, humans, and more. Most of the literature on cybersecurity indicate that after an attack, it is typical to focus on the symptoms of an attack and fix the problem as needed. Many times, the roots of an attack may still exist and manifest as a new attack. This process goes on as a \"cat and mouse\" game in a never-ending cycle. It is essential to find and remove the root causes of cyberattacks to eliminate them. In current information systems, cyberattack roots are inherently hidden in the architecture, protocols, policies, procedures, objectives, requirements, design, and implementation of these systems. Thus, it is harder to remove them as it assumes global markets and users. The cyberattack space is infinitely large, as shown in Figure 1, and it is difficult to comprehend and address all possibilities for a given cyberattack. Eliminating the roots of cyberattacks may require revolutionary and non-evolutionary approaches, which are not the focus of current cybersecurity research.  
\begin{table}
\begin{tabular}{p{42.7 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Seq.** & **System Characteristics** & **Conventional Systems** & **PECSV** & **BMC Systems** & **PRCSV** \\ \hline
21 & Computing Device & \begin{tabular}{c} Valuable Resources \\ (Storage, OS, Other) \\ \end{tabular} & \(\triangleq\) Obvious & \
\begin{tabular}{c} No valuable resources \\ (Bare) \\ \end{tabular} &
\begin{tabular}{c} \\ BMC Characteristic 21 \\ \end{tabular} \\ \hline
22 & \begin{tabular}{c} Application-program \\ Control \\ \end{tabular} & No, OS controls it & \
\begin{tabular}{c} Yes, Domain-specific \\ application suite \\ controls the control \\ flow as designed \\ \end{tabular} &
\begin{tabular}{c} \\ BMC Characteristic 22 \\ \end{tabular} \\ \hline
23 & Users & Global, All & \(\triangleq\)[2] & \
\begin{tabular}{c} Only Bare Users, \\ Authorized \\ \end{tabular} &
\begin{tabular}{c} \\ BMC Characteristic 23 \\ \end{tabular} \\ \hline
24 & Messages & \begin{tabular}{c} May not have valid \\ authentication \\ \end{tabular} & \(\triangleq\)[2] & \
\begin{tabular}{c} Each message contains \\ encrypted bare user \\ authentication \\ \end{tabular} &
\begin{tabular}{c} \\ BMC Characteristic 24 \\ \end{tabular} \\ \hline
25 & User-Secured USBs & N/A & \
\begin{tabular}{c} Uses two USBs, boots, \\ and an encrypted \\ application suite \\ \end{tabular} &
\begin{tabular}{c} \\ BMC Characteristic 25 \\ \end{tabular} \\ \hline
26 & BIOS/Firmware & Not bundled with OS & \(\triangleq\)[91] & \
\begin{tabular}{c} Bundled with the \\ domain-specific \\ application suite \\ \end{tabular} &
\begin{tabular}{c} BMC Characteristic 26 \\ \end{tabular} \\ \hline
27 & Protocols & Layered protocols & \(\triangleq\)[92] & \
\begin{tabular}{c} Integrated with the \\ application-suite \\ \end{tabular} &
\begin{tabular}{c} BMC Characteristic 27 \\ \end{tabular} \\ \hline
28 & Passwords & Password files part of OS structures & \(\triangleq\)[13, 93] & \
\begin{tabular}{c} No password files \\ (authentication stored \\ in program structures) \\ \end{tabular} &
\begin{tabular}{c} BMC Characteristic 28 \\ \end{tabular} \\ \hline \hline \end{tabular}
\end{table}
Table 2: _Cont._