GLIMPS Malware Takes Data Decontamination to the Next Level in Air-Gapped Environments

Air-gapped environments are designed to operate without any connection to the outside world. Commonly used in the finance, defense, and energy sectors, these isolated environments rely on network interconnection gateways equipped with data diodes for one-way data transfers.

This analog technology, based on optical physics, ensures that air-gapped environments remain shielded from standard cyberattacks while still allowing limited, controlled data exchange. However, the data flowing through these gateways must still be analyzed and sanitized to prevent advanced compromise attempts.

It is in this context that GLIMPS partnered with Thales in a technology partnership to deliver an innovative file decontamination process for the Elips Gateway interconnection gateway. Here’s how it works.

When an organization needs to protect highly sensitive data (trade secrets, industrial equipment specifications, or patented intellectual property) against any risk of compromise, a proven segmentation approach involves creating isolated networks with their own classification levels. A common example is the defense sector, where military programming legislation governs the handling of critical information within information systems through compartmentalization and filtering measures. To enable communication between these different environments, interconnection gateways using analog data diodes are standard practice. As a passive, unpowered device, the data diode enables one-way transfer, ensuring that information can flow from the low-side gateway (unsecured environment) to the high-side gateway (highly secured environment), but never the other way around.

As Cédric Gibert, Product Director at GLIMPS, explains: “Data diode technology is so transparent that it gives users the impression they’re using FTP, sending a file that will arrive on the other side. But unlike FTP, there is no interpretation, no computation in between, since the diode has no processor. It’s a purely passive device”. Likewise, a data diode provides no acknowledgment that the data was successfully received.

However, while one-way transfer limits exchanges with the environment, it says nothing about the nature of the information being exchanged. Data diodes have no built-in capability to sanitize the data they transmit. It is therefore essential to verify that data is safe by adding a dedicated security layer for analyzing and detecting malicious files.

To address this challenge, GLIMPS partnered with Thales, a European cybersecurity leader, to propose an innovative approach: integrating an enhanced antivirus solution for decontaminating files passing through the Elips Gateway.

This integration meets a real need to strengthen protection capabilities when exchanging information in air-gapped environments, especially given that conventional antivirus solutions let up to 35% of threats slip through.

The partnership allows users to easily select their preferred tool for sanitizing transferred files based on their specific needs, directly from the Elips Gateway. Integrating GLIMPS Malware into the Elips Gateway diode is straightforward, using GLIMPS APIs and an associated security key for a direct, hassle-free connection to GLIMPS servers.

The advantage of combining GLIMPS Malware with Elips Gateway is a highly secure data transmission pipeline. Security is reinforced through static file analysis at both the entry and exit points of the gateway, delivering continuous, reliable monitoring.

Leveraging code conceptualization analysis, GLIMPS Malware‘s proprietary concept-code technology, files are analyzed in just seconds, with no execution step and no access to source code required. Powered by 8 proprietary AI models and a database of several million malware samples, the tool can identify structural similarities across executable files by interpreting compiled functionalities. Platform-agnostic, GLIMPS Malware can also analyze all file types and numerous programming languages using over 25 different analysis engines.

As Cédric Gibert puts it: “While Elips Gateway already includes a built-in antivirus solution to verify that files aren’t compromised, GLIMPS Malware dramatically multiplies malware detection capabilities, strengthening overall network security.“

In the face of evolving cyber threats, from Advanced Persistent Threat (APT) attacks like the infamous Stuxnet to the growing wave of zero-day vulnerabilities, GLIMPS Malware‘s machine learning capabilities are designed to deliver proactive, up-to-date defense against the latest and most sophisticated threats.

The technology partnership between GLIMPS and Thales, embodied by the integration of GLIMPS Malware with Elips Gateway, represents a major advancement in air-gapped environment protection.

This solution delivers a comprehensive file sanitization process, ensuring that only legitimate data reaches air-gapped environments, adding a critical layer of protection against the compromise of isolated networks.