5 ms·

How do you connect a keyboard or mouse?

jay-anderson 8y ago
https://en.wikipedia.org/wiki/PS/2_port https://en.wikipedia.org/wiki/PS/2_port
genericone 8y ago
To be fair, they are not completely locked down like I may have made it sound. The usb port restriction is absolutely true for laptops, but colo desktops probably do not have this restriction, or just a more lax restriction. Also, its not true for all laptops of the company, but usb access does require explicit permissions and a new-issue laptop, so they do have a list of people who have riskier laptops, and may need to be issued a different travel laptop vs engineering laptop. The laptop's epoxied ports likely prevent distracted traveling workers from having their laptops hacked with usb-keys inserted when they aren't looking.
- pjmlp 8y ago
  The solution I have seen for desktops is to put them inside a locked metal case. You cannot access anything besides the power button.
- StringyBob 8y ago
  I've seen the 'USB ports get taped up for a visiting engineers computer' thing before - so I wonder what they do with a MacBookPro nowadays (there is no separate display or power connector!)
  - AstralStorm 8y ago
    They use a laptop suited for business, obviously.
dogma1138 8y ago
An implementation I’ve seen had all ports locked down on the laptop itself and physically locked with a plastic plug that can’t be removed without leaving evidence. The keyboard and mouse were connected to a dock. On the OS level only HID devices were allowed via USB you could bypass this if you had admin rights but it would leave a trail. The idea behind these like most other security controls is to prevent accidental leakage and to make it difficult enough that intentional leakage would likely be detecte on time.
- mseebach 8y ago
  > you could bypass this if you had admin rights but it would leave a trail A move I've seen being put in place at several locations, is removing local admin rights from all users. Those with advanced needs, like developers, gets a VM which is limited to a specific VLAN, with no access to the production environments. The principle is sound, implementation is ... difficult, to say the least.
  - jacquesm 8y ago
    And if you're willing to run a lot of screencaps or re-type the stuff you see on another computer you can still get the data out. Before modems were common in the hands of unwashed masses my friend and I would transfer files on the phone by spelling out blocks in hex. Slow but with a checksum every 16 bytes it was good enough to get some work done. If the data is high value enough it would probably be worth it.
    - mseebach 8y ago
      Airgapped exfil is a whole research field. Priority one is making accidental leaks or infections all but impossible. Priority two is making large scale intentional leaks as slow and difficult as possible. As long as there are human eyes on the data, some level of leaking is possible.
    - dogma1138 8y ago
      Any host based DLP will monitor and block screen caps you also need to get them out some how. Printing will also be heavily restricted and monitored. Sure no DLP solution would beat pen and paper but that’s not a good way to exfiltrate data these days and a security guard checking people leaving a restricted area would be a good enough way to plug any leaks.
      - ekovarski 8y ago
        All of these technologies are great to prevent employees from casually stealing data but as history has proven, usually while the front is well guarded, the back end many times has quite a few holes for hackers to exploit. It's like they say, the most secure computer is the one not connected to the network.
deleted 8y ago
[deleted]
khedoros1 8y ago
A docking station.
- bhandziuk 8y ago
  Can't you just moved the usb ports around? What's the difference? (Edit: Haven't --> Can't)
  - khedoros1 8y ago
    (Realizing this is from a week ago...) A docking station usually has a lot more than just USB ports. Mine has three monitor connections, more USB ports than the laptop itself, a power connection, and an RJ-45 jack. One of the benefits is the expanded number of connectors. Another benefit is that I don't have to unplug half a dozen items to take the laptop with me; I just hit the eject button and pick the laptop up. In the same way, reconnecting all that stuff is achieved by just plopping the laptop onto the dock. Best of both worlds: Portability of the laptop itself, and the easy expansion of the laptop's capabilities in situations where the expansion is useful (e.g. somewhere that I can keep a bunch of big monitors, and would benefit from a non-mobile work area).
xaldir 8y ago
Now you know why the PS/2 port is still around.

https://en.wikipedia.org/wiki/PS/2_port https://en.wikipedia.org/wiki/PS/2_port

To be fair, they are not completely locked down like I may have made it sound. The usb port restriction is absolutely true for laptops, but colo desktops probably do not have this restriction, or just a more lax restriction. Also, its not true for all laptops of the company, but usb access does require explicit permissions and a new-issue laptop, so they do have a list of people who have riskier laptops, and may need to be issued a different travel laptop vs engineering laptop. The laptop's epoxied ports likely prevent distracted traveling workers from having their laptops hacked with usb-keys inserted when they aren't looking.

pjmlp 8y ago
The solution I have seen for desktops is to put them inside a locked metal case. You cannot access anything besides the power button.
StringyBob 8y ago
I've seen the 'USB ports get taped up for a visiting engineers computer' thing before - so I wonder what they do with a MacBookPro nowadays (there is no separate display or power connector!)
- AstralStorm 8y ago
  They use a laptop suited for business, obviously.

dogma1138 8y ago

An implementation I’ve seen had all ports locked down on the laptop itself and physically locked with a plastic plug that can’t be removed without leaving evidence. The keyboard and mouse were connected to a dock. On the OS level only HID devices were allowed via USB you could bypass this if you had admin rights but it would leave a trail. The idea behind these like most other security controls is to prevent accidental leakage and to make it difficult enough that intentional leakage would likely be detecte on time.

mseebach 8y ago
> you could bypass this if you had admin rights but it would leave a trail A move I've seen being put in place at several locations, is removing local admin rights from all users. Those with advanced needs, like developers, gets a VM which is limited to a specific VLAN, with no access to the production environments. The principle is sound, implementation is ... difficult, to say the least.
- jacquesm 8y ago
  And if you're willing to run a lot of screencaps or re-type the stuff you see on another computer you can still get the data out. Before modems were common in the hands of unwashed masses my friend and I would transfer files on the phone by spelling out blocks in hex. Slow but with a checksum every 16 bytes it was good enough to get some work done. If the data is high value enough it would probably be worth it.
  - mseebach 8y ago
    Airgapped exfil is a whole research field. Priority one is making accidental leaks or infections all but impossible. Priority two is making large scale intentional leaks as slow and difficult as possible. As long as there are human eyes on the data, some level of leaking is possible.
  - dogma1138 8y ago
    Any host based DLP will monitor and block screen caps you also need to get them out some how. Printing will also be heavily restricted and monitored. Sure no DLP solution would beat pen and paper but that’s not a good way to exfiltrate data these days and a security guard checking people leaving a restricted area would be a good enough way to plug any leaks.
    - ekovarski 8y ago
      All of these technologies are great to prevent employees from casually stealing data but as history has proven, usually while the front is well guarded, the back end many times has quite a few holes for hackers to exploit. It's like they say, the most secure computer is the one not connected to the network.

deleted 8y ago

[deleted]

khedoros1 8y ago

A docking station.

bhandziuk 8y ago
Can't you just moved the usb ports around? What's the difference? (Edit: Haven't --> Can't)
- khedoros1 8y ago
  (Realizing this is from a week ago...) A docking station usually has a lot more than just USB ports. Mine has three monitor connections, more USB ports than the laptop itself, a power connection, and an RJ-45 jack. One of the benefits is the expanded number of connectors. Another benefit is that I don't have to unplug half a dozen items to take the laptop with me; I just hit the eject button and pick the laptop up. In the same way, reconnecting all that stuff is achieved by just plopping the laptop onto the dock. Best of both worlds: Portability of the laptop itself, and the easy expansion of the laptop's capabilities in situations where the expansion is useful (e.g. somewhere that I can keep a bunch of big monitors, and would benefit from a non-mobile work area).

xaldir 8y ago

Now you know why the PS/2 port is still around.