# An Evaluation of the Security of Bare Machine Computing (BMC) Systems against Cybersecurity Attacks
## 3 Bare Machine Computing (BMC) Systems
### Properties of the BMC Paradigm
#### 3.5.2 BMC Characteristics
Other protocols are not available outside the application running on the machine. Each application communicates only with its peers to ensure reliability and proper functionality. Furthermore, protocols are integrated within the application, and there are no protocol layers as in a conventional system. The attacker does not have the path to invoke these protocols. Although an attacker can spoof IP addresses, such packets will fail user authentication and be dropped. Every packet has bare user authentication, encryption, an integrity check, and replay protection. * Passwords: No password files are stored on bare machines. Context-based authentication is used in bare systems. The above BMC system guidelines and characteristics impose many restrictions for user options. This does not mean that the BMC applications have limited their user functionality. Any features or functions offered by conventional systems can also be provided by BMC applications. The functional requirements, design, and implementation are conducted in many ways to achieve the highest security possible by design. In many cases, a given functionality, protocols, and interfaces are hidden in an application. This is referred to as an A-to-A (application-to-application) approach. For example, email attachments and downloads are not allowed in BMC characteristics. Users can still receive an attachment as a set of packets without explicitly providing attachment features. A sender and a receiver of an email application handle the disassembly and assembly of packets in their respective applications with a hidden knowledge of file characteristics. All emails and additional packets are encrypted when transmitted on a network. At the receiving site, it is ensured that this file data cannot be executed. Thus, attachments are handled differently than in conventional systems. Many other convenient features in conventional systems are implemented in BMC applications in a hidden manner. Similarly, in BMC, software downloads are not allowed. All software that runs on a bare machine must be physically installed on a bootable USB by an authorized vendor for an authorized bare user. It is not convenient for bare users, but it is the most secure way to design BMC applications. As per the following quotation, \"In recent years, more advanced versions of \"security through obscurity\" have gained support as a methodology in cybersecurity through Moving Target Defense and cyber deception. NIST's cyber resiliency framework, 800-160 Volume 2, recommends the usage of security through obscurity as a complementary part of a resilient and secure computing environment\" [55]. BMC code can run on older and new Intel processors without any (or just a few) changes. The variety and breadth of the BMC work [54, 53, 55, 56] show that it is possible to build similar systems for secure applications in computer and information systems. The BMC paradigm can thus be an alternative to existing OS-based platforms and applications with security by design.