The Linux universe has placed at our disposal a huge number of distributions that can be modified and adapted to taste, but when the security of a computer is non-negotiable, something special is needed. That something is Qubes OS, a derived operating system whose main role is to act as a hypervisor, compartmentalizing specific applications and work environments with the aim of preventing a single attack from bringing down the entire computer and its contents.
Current computer security needs a change, we all know that. What we don't know exactly is how to implement it. Traditional protection methods are losing effectiveness at an alarming rate, and to that detail are added extreme situations such as the bad practices of some administrators, or the appearance of bugs that have been dormant in code for years. A relatively popular technique is to enclose processes in a sandbox. While this helps contain many threats, reality tells us that it is not impossible for a piece of malware to escape a sandbox, and once it does, well... let's say nobody wants that.
Qubes OS: A Different Approach
The approach of Qubes OS is a little different. As its developers explain on the official site, Qubes OS offers security to its users through a mechanism that keeps isolated several domains or “security zones” (for example, one for the word processor and another for the web browser). In other words, the system uses the Xen hypervisor, and each of those domains is itself a virtual machine. If you are thinking about tools like VirtualBox, the truth is that Qubes OS goes further. Both VirtualBox and its direct competitors are type 2 hypervisors, and at the end of the day they provide the same security as the host operating system. In contrast, Qubes OS is equivalent to a type 1 hypervisor, so it works directly on the metal.
Qubes OS 3.0 and Beyond
Qubes OS reached version 3.0 last week, and among its advances we detected the appearance of Xen 4.4, as well as the incorporation of HAL (Hypervisor Abstraction Layer), which allows changing hypervisors more easily. The only problem is that the learning curve in Qubes OS offers no mercy. This is not Ubuntu, ladies and gentlemen. Qubes OS carries important limitations in hardware compatibility, and they still need to add UEFI support, but all this will improve with the arrival of version 3.1, which will include a Live USB version. We need to keep an eye on it.
