Virtual air-gapped endpoint, and methods thereof

A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process for operating an air-gapped endpoint, the process comprising:

• initializing, on the air-gapped endpoint, a hypervisor for execution over a primitive operating system (OS) of the air-gapped endpoint;
• creating a plurality of isolated security zones by instantiating a plurality of corresponding virtual machines using the hypervisor, wherein each of the plurality of security zones includes a plurality of applications executed over a guest OS;
• instantiating a networking virtual machine using the hypervisor, wherein the network virtual machine is instantiated to operate in a non-persistent mode;
• controlling, by the networking virtual machine, access of each application in each of the plurality of security zones to an external network resource;
• reverting the networking virtual machine to its initial state upon at least a disconnect event from the external network resource;
• and
• monitoring execution of the guest OS and each application in at least one activated security zone of the plurality of security zones, wherein the monitoring is performed to maintain compliance with a security policy corresponding to each activated security zone being monitored, wherein the primitive OS is executed by a hardware layer of the air-gapped endpoint, and wherein the primitive OS is configured to execute only pre-signed code of device drivers.

An air-gapped computing system, comprising:

• a network interface card;
• a processing circuitry;
• and
• a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
• initialize a hypervisor for execution over a primitive operating system (OS);
• create a plurality of isolated security zones by instantiating a plurality of corresponding virtual machines using the hypervisor, wherein each of the plurality of security zones includes a plurality of applications executed over a guest OS;
• instantiate a networking virtual machine using the hypervisor, wherein the network virtual machine is instantiated to operate in a non-persistent mode;
• control, by the networking virtual machine, access of each application in each of the plurality of security zones to an external network resource;
• revert the networking virtual machine to its initial state upon at least a disconnect event from the external network resource;
• and
• monitor execution of the guest OS and each application in at least one activated security zone of the plurality of security zones, wherein the monitoring is performed to maintain compliance with a security policy corresponding to each activated security zone being monitored, wherein the primitive OS is executed by a hardware layer of the air-gapped endpoint, and wherein the primitive OS is configured to execute only pre-signed code of device drivers.