Industry: Defence
IT security and deployment for the defence sector
Software that works without internet, without a domain and without cloud - and proves every step. For defence-related organisations, system houses and suppliers to the defence industry, from a German vendor without outside influence.
What is different in the defence sector
Much of what enterprise IT takes for granted is simply absent here: cloud services, a permanent internet connection, a central Active Directory, tools with telemetry. In their place come requirements that rarely arise in corporate IT. Our software is built for exactly these conditions - not adapted to them afterwards.
The air gap is the normal case
Networks without internet, often without a domain; devices that never go online. omniDEPLOY brings DNS, DHCP, network boot and all content along and never needs to reach outside. SecCheck collects without internet and hands the result over in a controlled way. File-INNsider verifies signatures and checksums offline. No component requires a cloud.
Secure Boot stays on, cryptography as required
Secure Boot must remain enabled, and so must the revocations against BlackLotus (CVE-2023-24932). omniDEPLOY boots with Secure Boot enabled through a chain signed end to end up to the Windows UEFI CA 2023. The deployment server runs on Linux, hardened to BSI IT-Grundschutz building blocks, in FIPS mode if required. Devices are hardened to CIS Level 2, BSI or Microsoft Security Baseline; SecCheck additionally maps deviations to the DoD STIG.
Evidence instead of assurance
Auditors and contracting authorities want evidence per device and per batch, not promises. Every deployment leaves a deploy record and a compliance check against the template's target, every approval a record with name, reason and time, every version a hash. SecCheck delivers the reproducible report on the security state - with timestamp, script version and target values per standard.
Controlled supply chain
Software builds are produced in a build environment with network access and reach the isolated target environment as a signed release export on removable media through a data lock. Inside, the operator only moves pointers between the stages dev, qa, uat and prod - never content. Manifest and SHA-256 per file make every build traceable.
Our products in the defence sector
Four products, one principle: no additional runtimes, signed, offline-capable, no telemetry. Two of them carry your project, two make your administrators' daily work easier.
omniDEPLOY - the core
Install, harden and verifiably deliver Windows devices in an isolated network automatically: PXE boot with Secure Boot enabled, device record instead of MAC list, approval by a person before any wipe, hardening during deployment, deploy record and compliance check afterwards. For industrial PCs, terminals and special workstations with long service lives - Windows 10 IoT Enterprise LTSC 2021 and Windows 11 LTSC, drivers per model, redeploy instead of patching.
More about omniDEPLOYSecCheck - the evidence
Read-only scan without an agent, report per device with target values according to Microsoft Security Baselines, BSI SiSyPHuS, CIS Benchmarks and DoD STIGs, risk score per chapter. Collection without internet; with the Platinum license the evaluation also runs entirely in your environment, without external storage. The report that auditors and contracting authorities can verify.
More about SecCheckFile-INNsider - package integrity
Before an installation package passes the lock: Authenticode signature with signer, issuer and status, checksums from MD5 to SHA-512 - straight from the Explorer context menu, offline, as a text block for the approval record. Free, as a signed MSI.
More about File-INNsiderWin-INNsider - support without telemetry
Device information and support info in fixed lines for the helpdesk, quick toggles for touch, presentation and power - as a tray tool without any cloud connection. Distributed as MSI through your software distribution or Group Policy; with a support contract you control updates yourself - through your own update mirror inside the isolated network or with the version check switched off - and replace the banner with yours.
More about Win-INNsiderHow we work with you
An introduction in the defence sector is a project with clear handover points - and in the end your own people operate the system.
- Target picture and model groups. Which devices, which networks, which requirements for hardening, cryptography and evidence; which standards apply, where deviations must be justified.
- Lab instance at BitStream. Intake of your reference devices, images, drivers and packages; hardening catalogue to your requirements; internal acceptance; signed release export.
- Your instance. Import of the release through the data lock, acceptance in uat, promotion to prod - on your server, in your network, with no connection to us.
- Handover. Operations manual, training, operating model with clear roles per core process; the Workbench for your administrators' workstations. After that we accompany the builds - at your request and over your channel.
Confidentiality is part of the product. We name no customers on this website and show no reference logos. Our project documentation is pseudonymised: customer names, host names and addresses never appear in sources or tools, only on the customer's server. We arrange reference conversations only with the consent of the customer concerned.
At a glance
- Operation
- Without internet, without a domain, without cloud; deployment server on Linux (Red Hat Enterprise Linux), one server per site
- Boot
- PXE with Secure Boot enabled; signed chain shim, iPXE, wimboot, Windows boot manager with Windows UEFI CA 2023
- Cryptography
- Server operation in FIPS mode available; every file pinned by SHA-256; signed release export
- Hardening
- CIS Level 2, BSI, Microsoft Security Baseline as versioned layers; SecCheck mapped to Microsoft, BSI SiSyPHuS, CIS and DoD STIGs
- Evidence
- Device record, approval records, deploy record, compliance check, hash inventory, batch protocols, SecCheck reports per device
- ISO 27001
- SecCheck reports per device as technical evidence for ISMS audits and classified-information requirements
- Supply chain
- Build environment with network access, data lock, isolated target environment; stages dev, qa, uat, prod
- Devices
- Heterogeneous industrial and standard PCs with UEFI; Windows 10 IoT Enterprise LTSC 2021, Windows 11 LTSC; long service lives
- Vendor
- BitStream GmbH, Passau, Germany, since 2014; fully self-financed, no external investors
A supplier without outside influence
Procurement and security officers rightly ask about the origin and ownership structure of a supplier. The answers are short:
- German vendor - BitStream GmbH, based in Passau, founded in 2014, participant in the BSI's Alliance for Cyber Security.
- Self-financed - entirely from our own resources, independent of external investors; decisions follow product and customers, not investor interests.
- No telemetry - none of our tools sends usage data; whatever is hosted is hosted in the EU.
- No outflow of project data - pseudonymised documentation, customer data only on the customer's server.
- Signed software - programs and packages carry an EV code signature; boot binaries are proven against the Windows UEFI CA 2023.
Consulting from practice
Whoever builds software for isolated networks knows the questions that come first: hardening to BSI, CIS and Microsoft, Active Directory tiering, target pictures for client and deployment architectures without Intune or domain, evidence for auditors. Our consulting brings more than 20 years of practice with public authorities, critical infrastructure operators and large enterprises to this - and the experience from our own products in the defence sector.
A conversation, or a demo in the lab
Let us show you: a device from your model group, a deployment with Secure Boot enabled, the evidence afterwards - in our lab or on your reference hardware. Tell us about your environment and we will get back to you.
Or directly: +49 851 204248-0 ยท info@bitstream.de