DARPA Taps RTX to Strengthen Cyber Resiliency
November 11, 2024 | RTXEstimated reading time: 2 minutes
RTX's BBN Technologies was awarded a contract to support DARPA's Compartmentalization and Privilege Management, or CPM, program. The CPM program aims to enhance cyber resilience by automatically subdividing software systems into smaller, secure compartments, preventing initial breaches from escalating into successful cyberattacks while maintaining system efficiency.
According to the U.S. Government Accountability Office, the U.S. Department of Defense has experienced more than 12,000 cyber incidents since 2015. These incidents threaten personal privacy as well as national security. The most common exploit involves a hacker gaining access to a system and then taking advantage of coding errors that allow them to escalate their system privileges to gain access to sensitive data or to take control of the system.
Under CPM, BBN is developing the Analysis and Restructuring for Containment (ARC) tool to thwart unauthorized privilege escalations and lateral movements within software systems. ARC will be engineered to automatically analyze large code bases and construct smaller, secure compartments. By applying the principle of least privilege at a sub-program level, the tool will ensure that only the minimum access necessary is granted for code to execute. This approach to software security will significantly limit the scope of potential damage in the event of a successful infiltration of the software.
"Today's complex attack surfaces and increasingly sophisticated cyberattacks mean that even a single point of vulnerability can compromise an entire system," said Aaron Paulos, BBN principal investigator. "Our solution will enhance the security of critical software systems while preserving performance, which is essential for maintaining operational readiness. The goal is to create compartments that isolate risks, making systems more resistant to cyberattacks."
A key element of the program is the requirement to minimize the impact of compartmentalization on overall performance while producing secure, tight compartments. To achieve this, ARC will generate solutions that balance multiple objectives. For instance, some parts of software application will require performant access, while others might introduce significant exposure to risk. The tool will enable system administrators to selectively apply security measures to those areas deemed most critical, as a way of managing the trade-offs between performance and security.
ARC builds on several unique capabilities from BBN's prior work in cybersecurity and software analysis. The team intends to integrate capabilities that use:
- Automated program analysis to assess and identify potential threats in software, ensuring thorough evaluation and security.
- Verifiable program restructuring to improve security and controls, including adjustments to memory and function usage.
- Automated reasoning to develop effective security solutions by exploring different options and balancing performance with risk management.
- The BBN-led team includes Northwestern University, George Washington University and Kestrel Institute. Work on the program will be completed in Cambridge, Massachusetts; Evanston, Illinois; Washington, D.C.; and Palo Alto, California.
This material is based upon work supported by the United States Air Force and DARPA under contract number FA8750-23-C-B031. Any opinions, findings, and conclusions or recommendations expressed in this material are those of the author and do not reflect the views of the United States Air Force and DARPA.
Testimonial
"The I-Connect007 team is outstanding—kind, responsive, and a true marketing partner. Their design team created fresh, eye-catching ads, and their editorial support polished our content to let our brand shine. Thank you all! "
Sweeney Ng - CEE PCBSuggested Items
Siemens, PTC, and Dassault Systèmes Named Leaders in ABI Research's PLM Assessment for Large Discrete Manufacturers
07/28/2025 | PRNewswireThe Product Lifecycle Management (PLM) market has witnessed significant developments over the past year with the rise of Software-as-a-Service (SaaS), digital twins, and Generative AI (Gen AI) becoming integral for large discrete manufacturers.
Elementary, Mr. Watson: Rein in Your Design Constraints
07/10/2025 | John Watson -- Column: Elementary, Mr. WatsonI remember the long hours spent at the light table, carefully laying down black tape to shape each trace, cutting and aligning pads with surgical precision on sheets of Mylar. I often went home with nicks on my fingers from the X-Acto knives and bits of tape all over me. It was as much an art form as it was an engineering task—tactile and methodical, requiring the patience of a sculptor. A lot has changed in PCB design over the years.
Stop Using Spreadsheets—and You Can Quote Me on That
07/03/2025 | Nolan Johnson, SMT007 MagazineMeeting changing business needs and a thriving market sometimes means process efficiencies. Not all those efficiency improvements take place on the shop floor, however. For EMS companies, growth can also mean changing out the business operations software to have one more chance to close a business deal that better aligns with the company’s sweet spot. One of the pressing issues for EMS companies is the great deal of attention on sales and quoting software solutions and how to make them perform better. Chintan Sutaria, the founder and former CEO of CalcuQuote now working on other projects at OpenJar, explains.
IPC-CFX, 2.0: How to Use the QPL Effectively
07/02/2025 | Chris Jorgensen, Global Electronics AssociationIn part one of this series, we discussed the new features in CFX Version 2.0 and their implications for improved inter-machine communication. But what about bringing this new functionality to the shop floor? The IPC-CFX-2591 QPL is a powerful technical resource for manufacturers seeking CFX-enabled equipment. The Qualified Product List (QPL) helps streamline equipment selection by listing models verified for CFX compliance through a robust third-party virtual qualification process.
NXP Completes Acquisition of TTTech Auto to Accelerate the Transformation to Software-Defined Vehicles
06/21/2025 | NXP SemiconductorNXP Semiconductors N.V. announced the completion of the acquisition of TTTech Auto , a leader in innovating unique safety-critical systems and middleware for software-defined vehicles (SDVs), pursuant to the terms of the previously announced agreement from January 2025.