VMware利用人工智能在其产品中发现了如此多的漏洞，以至于它觉得自己有必要创造一款新产品来帮助用户管理这些漏洞。博通公司VMware云基金会（VCF）部门的产品营销副总裁普拉尚特·谢诺伊向《The Register》透露，VMware最近开始提供每月的软件更新，部分原因是为了解决人工智能发现的漏洞。然而他承认，在转向按月发布之前，用户就很难跟上更迭的速度，因为测试补丁的影响需要时间——尽管VCF允许进行无中断的实时修补。
VMware has discovered so many flaws in its products using AI that it felt the need to create a new product to help users manage them. Prashanth Shenoy, vice president of product marketing in the VMware Cloud Foundation (VCF) division of Broadcom, told The that VMware recently moved to deliver monthly software updates, in part to address bugs found by AI. He admitted, however, that users struggled to keep up with the pace of change before the move to monthly releases because it takes time to test the impact of patches – even though VCF allows non-disruptive live patching.
谢诺伊表示，因此客户需要“喘息的空间”。于是，一款名为HyperArmor的新工具应运而生，它具有三大功能。
Shenoy said customers therefore need "room to breathe." Enter a new tool called HyperArmor, which does three things.
其一是“虚拟修补”——在不改变脆弱软件本身的情况下，阻止利用漏洞的尝试。VMware已经在其vDefend网络安全产品中提供了虚拟修补功能，并以CVE-2024-5806为例解释了其工作原理，这是2024年引起轰动的文件传输工具MOVEIt中的漏洞。VMware表示，vDefend可以检测与利用身份验证绕过漏洞尝试相关的模式并阻止流量。HyperArmor将采取类似的做法，阻止流向VCF实现的恶意流量。
One is "virtual patching" – blocking attempts to exploit a vulnerability without changing the vulnerable software itself. VMware already offers virtual patching in its vDefend network security product and explains how it works by referring to CVE-2024-5806, the bug in file transfer tool MOVEIt that made waves in 2024. VMware says vDefend can detect patterns associated with attempts to exploit the authentication bypass flaw and block the traffic. HyperArmor will do similar things to block malicious traffic heading toward VCF implementations.
HyperArmor承担的第二项工作是拒绝任何改变VCF中已知良好状态的操作。如果有人批准了一项更改，该工具将更新策略以允许更改后的状态。
Another job HyperArmor takes on is rejecting any actions that alter known good states in VCF. If a human approves a change, the tool will update policies to allow the altered state.
第三项工作是多因素身份验证（MFA）。《The Register》向谢诺伊指出，MFA现在是安全的基本要求。他对此表示赞同，但解释说VMware设计HyperArmor是为了防范攻击者使用窃取的特权凭据来访问VMware的ESX虚拟机监控程序。为了（有望）阻止攻击者使用这些凭据接管主机，HyperArmor要求用户输入SSH凭据以及发送给已验证身份的用户的次要基于时间的一次性密码。
The third job is multi-factor authentication (MFA). The put it to Shenoy that MFA is now table stakes for security. He agreed but explained that VMware designed HyperArmor to protect against attackers using stolen privileged credentials to access VMware's ESX hypervisor. To (hopefully) stop attackers using those creds to take over a host, HyperArmor requires users to input SSH credentials and a secondary time-based one-time password sent to a user with a verified identity.
HyperArmor是一个独立的产品，VMware将作为VCF的附加组件出售。这意味着VMware认为其客户会愿意为MFA支付额外费用。虽然VMware将销售HyperArmor，但它并不是该产品的缔造者。博通旗下的安全业务赛门铁克和Carbon Black开发了它。博通的CA业务（前身为Computer Associates）也做过类似的事情。
HyperArmor is a discrete product that VMware will sell as an add-on to VCF. That means VMware thinks its customers are going to be OK paying extra for MFA. While VMware will sell HyperArmor, it didn't create the product. Broadcom's security businesses Symantec and Carbon Black cooked it up. Broadcom's CA business (formerly Computer Associates) has done similar things.
在8月31日的VMware Explore大会上，博通推出了AgentMinder，旨在阻止VCF内部运行的人工智能失控。AgentMinder来自CA，但作为面向VCF（以及第三方Kubernetes技术栈）的工具发布。在VMware Explore大会上，《The Register》见到了博通基础设施软件集团总裁拉姆·韦拉加，并询问该集团是拥有单一战略，还是各部门各行其是。韦拉加表示，博通结合使用了这两种方法。
At VMware Explore on August 31, Broadcom launched AgentMinder, which aims to stop AI running inside VCF going rogue. AgentMinder came from CA but was launched as a tool for VCF (and third-party Kubernetes stacks). At VMware Explore, The met Ram Velaga, president of Broadcom's Infrastructure Software Group, and asked him if the group has a single strategy, or if its divisions each do their own thing. Velaga said Broadcom uses a combination of both approaches.
“各个团队所拥有的专注度，是拥有一个非常庞大的核心团队所不具备的，”他说道。“你可以通过各个团队获得创新所需的速度。”
"There's a level of focus with individual teams that you don't have if you have one very large central team," he said. "You get the speed at which you have to innovate with individual teams."
因此，博通 Infrastructure Software Group 至少由六个团队组成，当其中一个团队想要添加功能时，它会寻找另一个内部团队开发的现有资产，而不是试图自己编写代码。因此，对于VCF这样的大型产品，博通几个团队的工作可能都是相关的。
Broadcom's Infrastructure Software Group therefore operates with at least six teams, and when one of those teams wants to add functions it will look for existing assets developed by another internal team rather than trying to write its own code. For broad products like VCF, the work of several Broadcom teams could therefore be relevant.
《The Register》不知道哪个团队创造了 HyperArmor 这个名字，我们提出这个问题是因为思科已经提供了一个“Hypershield”。也许这种名字正是阻止 HyperHoodie 所需要的？®
The has no idea which team created the name HyperArmor, a question we pose as Cisco already offers a "Hypershield." Maybe this sort of name is what's needed to stop a HyperHoodie? ®