3 ms·
Anything that is interesting at a bank, health or national security level should already be fairly well protected: * underground or otherwise well shielded fac
by reitanqild 10y ago
Anything that is interesting at a bank, health or national security level should already be fairly well protected:
* underground or otherwise well shielded facilities
* dedicated server rooms, switch rooms, comms rooms etc etc
* manned 2 stage gates for entry into facility + (electronic) access going into any department inside.
* strict regulations on what kind of equipment goes into the facility. (Wireless anything has been taboo since it came I think.)
What this doesn't handle is mostly:
* hostile sysadmins. You can only do so much about hostile insiders. Pair work, swapping peers, only allow updates once they have been vetted by a second crew etc can reduce the risk as can something as simple as being nice.
* hostile contractors that makes it through despite your extensive vetting. They must also be cold enough to bring fancy surveillance gear despite the risk of getting caught.
* stuxnet-levels of effort from a resourceful and determined opponent, piercing your firewall carefully from the inside. Still then it would take time to get anything meaningful from electronic noise (and at this point the attacker can likely just read the data from memory, Target Credit Card style.
- treebeard901 10y agoAll of this equipment needs power so that could be another attack vector. For example, we already have powerline networking. In theory you could include something like that in a power supply, after all it does connect to the motherboard and expansion cards. Of course it would require collusion among many different companies but it may not be out of the realm of a nation state attack.
- reitanqild 10y agoAgree. Then again a lot of power goes into such sites, often in redundant setups so actually exfiltating anything that way sounds like nation state level for me as well.
- SEJeff 10y agoNo it wouldn't, it would just require intercepting the computer / parts en-route: http://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-upgrade-factory-show-cisco-router-getting-implant/ http://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-...
- reitanqild 10y agoI remember reading about this. You are right. But to our defense: at this point we are again beyond the passive eavesdropping scenario I think we discussed above. When you own the networking gear it is more or less game over for the victim anyway, isn't it?