5 ms·

What does it mean for something to be an "air-gapped commercial cloud"?

by CJKinni 9y ago

jlgaddis 9y ago
The "Top Secret" cloud is not connected to the Internet.
- user5994461 9y ago
  Which obviously can't be true or it would be inaccessible and thus utterly useless.
  - jlgaddis 9y ago
    Why? It can still be connected to SIPRnet or JWICS. Or customers can get a Direct Connect from their existing facilities into the region. I presume the USG has plenty of fiber straight into these new datacenters and I'm not sure why Amazon wouldn't allow Direct Connect. As someone else mentioned, perhaps this will get contractors to stop using public S3 buckets to share data.
    - jsjohnst 9y ago
      That’s not “air gapped” if it’s connected to another government network.
      - jlgaddis 9y ago
        It's air-gapped from the Internet.
        Gigablah 9y ago
        What if it’s submerged in coolant?
        jsjohnst 9y ago
        The term “air gap” does not directly imply anything to do with the Internet (doesn’t exclude it, but it applies more generally than specific networks). Yes, IC uses it to signify high/low networks, but the original usage of the term was to indicate a machine with no direct connection to the outside world. The theory being (since proven wrong), you can’t exfiltrate data remotely from a device not connected to a network.
      - dsl 9y ago
        JWICS/SIPR/NSAnet/etc. are air gapped in that terminals are not allowed to be dual homed to any other network or to each other.
        jsjohnst 9y ago
        Yes, I know the inteligence community uses this definition of air gap to signify the barrier between high/low networks, but I kinda feel it misses the point of the term. If it is networked to the outside world, even securely, I feel it kinda misses the point of the “air gap” connotation (aka requiring a “sneaker net” to get data in / out). I’m likely being pedantic though, so I upvoted you as you at least gave a good response unlike others.
  - derefr 9y ago
    It’s useful insofar as it’s connected to itself, allowing individuals and companies to share data and compute with one-another, where data can ingress/egress manually but travel the network between VPCs automatically. It might also mean that the cloud is connected to networks that are not, themselves, Internet-routed. For example, users of the Secret region might have leased lines connecting airgapped computers in their own facilities directly to the DC for ingress/egress. It might also mean that the network is connected to a “different Internet”, like MILNET.
  - abiox 9y ago
    inaccessible for whom? the public internet isn't the only (inter)network that exists.
  - chiph 9y ago
    They likely connect via encrypted leased lines.
Zarathust 9y ago
They have a robot constantly hot-swapping disks between racks maybe?
- jo909 9y ago
  I know of two government approved methods for data transfers for closed networks, one of which is pretty close. You basically have two servers connected to the same disk array, and they take turns mounting it to move files onto/off it. There is of course scanning and logging and such involved. The other (unidirectional) method is a fibre pair connection that does not physically connect the TX with the RX in one direction, and there is some bumblefuckery that pushes the data through. Of course classified data is only transferred from networks with lower classification to networks with higher classification, never the other way.
  - justinjlynn 9y ago
    > bumblefuckery That is precisely how I would describe the Tenix and/or FOX-IT data pump implementations. It's amazing what people can manage to get away with even at EAL-7+.
  - SomeStupidPoint 9y ago
    Fun fact: many desktop printers can hit 3kbps in V40L QR codes (biggest + lowest ECC). (Estimated at approx 10ppm by 20KiB per code.) For the security conscious on a budget, printing QR codes to scan to a networked machine can be a way to get information off an otherwise air-gapped machine, with easy introspection and auditing. (This came up in the context of offline signing of Bitcoin transactions with a "warm" wallet -- digital, but airgapped from the "hot" wallets.)
  - Terretta 9y ago
    See Raytheon “High Speed Guard” description: PDF: https://www.raytheon.com/capabilities/rtnwcm/groups/gallery/documents/digitalasset/rtn_216064.pdf https://www.raytheon.com/capabilities/rtnwcm/groups/gallery/... From PR: Raytheon Trusted Computer Solutions (RTCS), a wholly owned subsidiary of Raytheon Company (NYSE: RTN), today announced that its High Speed Guard (HSG) big data transfer solution has received Cross Domain System Authorization and Authority to Operate for Secret and Below Interoperability (SABI). This allows government customers to connect to networks classified at secret and below, and enables them to start the SABI site test and evaluation toward full system accreditation. Raytheon's HSG solution is a commercial-off-the-shelf product that enables the rapid transfer of all types of data across multiple networks at different classification levels. With the industry's fastest bi-directional transfer rates of any guard technology and proven sustained transfer rates of more than nine gigabits per second, HSG is ideally suited for large-scale deployments that require rapid, automated data transfer.
mrep 9y ago
https://en.wikipedia.org/wiki/Air_gap_(networking) https://en.wikipedia.org/wiki/Air_gap_(networking)
jimktrains2 9y ago
It's probably connected only to the us government secret network (I forget the acronym) and not the public internet.
- nhf 9y ago
  The contracted top secret cloud is connected to JWICS. JWICS and SIPRnet (the secret counterpart) are both government internets (but are not the Internet with a capital I).

What does it mean for something to be an "air-gapped commercial cloud"?

jlgaddis 9y ago

The "Top Secret" cloud is not connected to the Internet.

user5994461 9y ago
Which obviously can't be true or it would be inaccessible and thus utterly useless.
- jlgaddis 9y ago
  Why? It can still be connected to SIPRnet or JWICS. Or customers can get a Direct Connect from their existing facilities into the region. I presume the USG has plenty of fiber straight into these new datacenters and I'm not sure why Amazon wouldn't allow Direct Connect. As someone else mentioned, perhaps this will get contractors to stop using public S3 buckets to share data.
  - jsjohnst 9y ago
    That’s not “air gapped” if it’s connected to another government network.
    - jlgaddis 9y ago
      It's air-gapped from the Internet.
      - Gigablah 9y ago
        What if it’s submerged in coolant?
      - jsjohnst 9y ago
        The term “air gap” does not directly imply anything to do with the Internet (doesn’t exclude it, but it applies more generally than specific networks). Yes, IC uses it to signify high/low networks, but the original usage of the term was to indicate a machine with no direct connection to the outside world. The theory being (since proven wrong), you can’t exfiltrate data remotely from a device not connected to a network.
    - dsl 9y ago
      JWICS/SIPR/NSAnet/etc. are air gapped in that terminals are not allowed to be dual homed to any other network or to each other.
      - jsjohnst 9y ago
        Yes, I know the inteligence community uses this definition of air gap to signify the barrier between high/low networks, but I kinda feel it misses the point of the term. If it is networked to the outside world, even securely, I feel it kinda misses the point of the “air gap” connotation (aka requiring a “sneaker net” to get data in / out). I’m likely being pedantic though, so I upvoted you as you at least gave a good response unlike others.
- derefr 9y ago
  It’s useful insofar as it’s connected to itself, allowing individuals and companies to share data and compute with one-another, where data can ingress/egress manually but travel the network between VPCs automatically. It might also mean that the cloud is connected to networks that are not, themselves, Internet-routed. For example, users of the Secret region might have leased lines connecting airgapped computers in their own facilities directly to the DC for ingress/egress. It might also mean that the network is connected to a “different Internet”, like MILNET.
- abiox 9y ago
  inaccessible for whom? the public internet isn't the only (inter)network that exists.
- chiph 9y ago
  They likely connect via encrypted leased lines.

Zarathust 9y ago

They have a robot constantly hot-swapping disks between racks maybe?

jo909 9y ago
I know of two government approved methods for data transfers for closed networks, one of which is pretty close. You basically have two servers connected to the same disk array, and they take turns mounting it to move files onto/off it. There is of course scanning and logging and such involved. The other (unidirectional) method is a fibre pair connection that does not physically connect the TX with the RX in one direction, and there is some bumblefuckery that pushes the data through. Of course classified data is only transferred from networks with lower classification to networks with higher classification, never the other way.
- justinjlynn 9y ago
  > bumblefuckery That is precisely how I would describe the Tenix and/or FOX-IT data pump implementations. It's amazing what people can manage to get away with even at EAL-7+.
- SomeStupidPoint 9y ago
  Fun fact: many desktop printers can hit 3kbps in V40L QR codes (biggest + lowest ECC). (Estimated at approx 10ppm by 20KiB per code.) For the security conscious on a budget, printing QR codes to scan to a networked machine can be a way to get information off an otherwise air-gapped machine, with easy introspection and auditing. (This came up in the context of offline signing of Bitcoin transactions with a "warm" wallet -- digital, but airgapped from the "hot" wallets.)
- Terretta 9y ago
  See Raytheon “High Speed Guard” description: PDF: https://www.raytheon.com/capabilities/rtnwcm/groups/gallery/documents/digitalasset/rtn_216064.pdf https://www.raytheon.com/capabilities/rtnwcm/groups/gallery/... From PR: Raytheon Trusted Computer Solutions (RTCS), a wholly owned subsidiary of Raytheon Company (NYSE: RTN), today announced that its High Speed Guard (HSG) big data transfer solution has received Cross Domain System Authorization and Authority to Operate for Secret and Below Interoperability (SABI). This allows government customers to connect to networks classified at secret and below, and enables them to start the SABI site test and evaluation toward full system accreditation. Raytheon's HSG solution is a commercial-off-the-shelf product that enables the rapid transfer of all types of data across multiple networks at different classification levels. With the industry's fastest bi-directional transfer rates of any guard technology and proven sustained transfer rates of more than nine gigabits per second, HSG is ideally suited for large-scale deployments that require rapid, automated data transfer.

mrep 9y ago

https://en.wikipedia.org/wiki/Air_gap_(networking) https://en.wikipedia.org/wiki/Air_gap_(networking)

jimktrains2 9y ago

It's probably connected only to the us government secret network (I forget the acronym) and not the public internet.

nhf 9y ago
The contracted top secret cloud is connected to JWICS. JWICS and SIPRnet (the secret counterpart) are both government internets (but are not the Internet with a capital I).