A practical acknowledgement of the information world is that vulnerabilities can be minimized, but their 100% eradication is only as real as catching the horizon. When the probability of an exploit cannot be totally eliminated, a practical prevention technique is to contain the impact of the exploit. Isolation techniques implemented in the hardware, software, and virtualized environments allow for minimizing the impact from an attack by a separation of territories.
To provide the reader with deeper insights into various isolation techniques, some of the common options are discussed in the following sections.
In process isolation, at runtime, the operating system isolates business and operational functional components from security components. Using a privilege-based hierarchy of protection domains, functions and data in more privileged layers are protected from an unintended or malicious failure in a less privileged layer (IIC-IISF...