Security features are necessary to protect fundamental system integrity, data authenticity, and data privacy properties. There is a limit however, when a system gets too complicated and costly to know whether features are properly deployed.

Given the perplexing conflations and disingenuous claims that pervade the cyber security market, it is fair to take a step back and ask:

What are the necessary features, what is protecting these features from subversion,  and how do we know when the system is protected and will stay protected?

The answer to these questions comes from assurance.

At a high level, a secure system is a system that behaves precisely as the IT stakeholder expects it to and is resilient to subversive attempts to change its behavior over the lifetime of the system.

More concretely, it is a system running on an authentic processor that hands control to the software platform in an authentic state—the platform then enforces a policy consistent with the stakeholders expected behavior and is resilient to subversive change attempt from all exposed interfaces.

Regardless of what security technology IT stakeholders choose to invest in, it is important to understand that at the bottom of any IT security solution is a processor and resource management software that security features inherit. Far too often the foundational integrity properties of CPU and software platform level services are taken for granted.