4 ms·
In the meantime, a high level of technical proficiency is needed to defend against monolithic personal computing environments that are hostile by design. * Ass
by gtcode 9y ago
In the meantime, a high level of technical proficiency is needed to defend against monolithic personal computing environments that are hostile by design.
* Assume personal computing environment is hostile
* Use an external firewall and have a whitelist-only policy
* Use an external NIDS
* Physically disable all hard-connected non-wired interconnectivity
Monitors and keyboards ("I leave message here on service but you do not call") still leak, of course, but this is a good start, and most people need to be concerned with practical attacks that could be carried out over the internet.
New Year's 2018 resolutions: 1) Review backup policy including backup testing procedures 2) Implement personal digital security measures
I've often thought that the current mentality of a "convenient" monolithic personal computing environment (whether an iPhone, laptop, or PC) doesn't properly assess threats.
When broadband internet first became popular in my area growing up, it was acceptable practice (and recommended by ISP's) to simply plug your non-firewall'ed DSL modem ethernet directly into your computer. It truly was unprotected sex in the worst possible way. Perhaps the next evolution will fundamentally reconsider personal computing design from a security-first perspective.
- marcosdumay 9y ago> Use an external firewall and have a whitelist-only policy How much do you trust that firewall? > ...it was acceptable practice (and recommended by ISP's) to simply plug your non-firewall'ed DSL modem ethernet directly into your computer You have to plug that modem into some non-firewalled computer. Honestly I trust a well kept PC much more than a firewall appliance.
- gtcode 9y agoYour reasoning has merit, of course. And, that's a sad commentary on the current state of affairs, in which one cannot trust a firewall appliance to do its job. Perhaps the movement for open source hardware should focus on minimal security appliances.
- 1001101 9y ago> How much do you trust that firewall? Not very much after seeing some of the Shadow Brokers revelations.
- guelo 9y agoThe only firewall I trust is a hardened openbsd running pf.
- squarefoot 9y agoHopefully on a non ME plagued platform.
- mulmen 9y agoYou can just disable ME in the BIOS to mitigate this right?
- Houshalter 9y agoHow?
- mulmen 9y agoHmm, looks like I conflated the AMT and ME. This does make it significantly worse.
- Fnoord 9y agoPC Engines APU [1] and APU2 [2] come with Coreboot as firmware. As do various competitors [3] [1] http://www.pcengines.ch/apu.htm http://www.pcengines.ch/apu.htm [2] http://www.pcengines.ch/apu2.htm http://www.pcengines.ch/apu2.htm [3] https://store.netgate.com/ADI/RCC-VE-2440.aspx https://store.netgate.com/ADI/RCC-VE-2440.aspx