Critical Infrastructure

Hosting for Systems Where
Failure Has Consequences

When the systems you host support essential services — energy, transport, water, telecommunications — every layer of security matters. DSEC OS provides infrastructure with mandatory defence-in-depth enforcement on hardware you physically control.

Pre-release — in-house production tested

Every Unnecessary Service Removed. Every Remaining One Confined.

Critical infrastructure systems are high-value targets. The standard approach of deploying on general-purpose hosting and hardening after the fact leaves attack surface that shouldn't exist in the first place.

DSEC OS starts from a minimal, hardened baseline. The Rocky Linux kernel is tuned to CIS Level 2 benchmarks. Unnecessary services are removed, not just disabled. Every remaining service runs within mandatory SELinux and AppArmor confinement with the minimum capabilities required.

  • CIS Level 2 hardened Rocky Linux — 97.4/100 benchmark score
  • Unnecessary services stripped, not just disabled
  • Mandatory SELinux type enforcement for every process
  • Per-container AppArmor profiles generated automatically
  • Seccomp syscall filtering limits the kernel surface exposed to each workload
  • Rootless container runtime — no root-capable processes
97.4
CIS Benchmark
247
Security Profiles
<2ms
Policy Overhead
Zero
Root Processes

Every Network Flow Controlled at the Process Level

Traditional network security operates at the perimeter — firewalls and VLANs. Once an attacker is inside the network, lateral movement is often trivial. For critical infrastructure, this model is dangerously insufficient.

DSEC OS uses eBPF-based policy enforcement to control network traffic at the process level. Every container operates in its own network namespace. Egress and ingress policies are enforced per-workload, not per-network. Unauthorised traffic is blocked and logged before it leaves the container.

  • Private network namespace per container
  • eBPF per-process traffic monitoring and enforcement
  • Whitelist-only egress policies — deny by default
  • All blocked connections logged with process identity
  • No lateral movement between workloads without explicit policy
NETWORK POLICY — SCADA GATEWAY
ALLOW ingress ← control-plane:8443
ALLOW egress → historian-db:5432
ALLOW egress → internal-ntp:123
DENY egress → 0.0.0.0/0 (all external)
DENY ingress ← 0.0.0.0/0 (all external)
— all violations logged + alerted —

Self-Contained. Air-Gap Ready. No External Dependencies.

Critical infrastructure hosting must operate independently of external services. An internet outage shouldn't take down your management plane. A DNS provider's bad day shouldn't affect your control systems.

DSEC OS is fully self-contained. It runs on your hardware with no dependency on cloud services, external APIs, or third-party infrastructure. Air-gapped deployment is supported for environments that require complete isolation from public networks.

  • Fully self-contained — no cloud or external API dependencies
  • Air-gapped deployment for the most sensitive environments
  • No telemetry, no phone-home, no update checks against external servers
  • Local package repositories for air-gapped update workflows
  • Built on open-source you can audit and verify
DSEC Management Plane
SELF-CONTAINED
Container Orchestration
SELF-CONTAINED
Security Policy Engine
SELF-CONTAINED
Audit & Logging
SELF-CONTAINED
Hardened OS + Storage
SELF-CONTAINED
Critical Infrastructure

Essential Services Deserve
Essential Security

If your organisation operates systems that support essential services, and your current hosting infrastructure doesn't meet the security standard those systems demand, we should talk.