6 ms·

> It also provides partitioning mechanisms that make it possible to simultaneously process public and sensitive information on the same computer, within two com

by comboy 8y ago

> It also provides partitioning mechanisms that make it possible to simultaneously process public and sensitive information on the same computer, within two completely isolated software environments, in order to avoid the risk of sensitive information leaking onto the public network. Just don't. Please don't. You can have the most sane architecture, but there's a whole pile of s..tack underneath. You can't even trust a modern CPU.

agumonkey 8y ago
worth a ticket on a bug tracker
ardy42 8y ago
>> It also provides partitioning mechanisms that make it possible to simultaneously process public and sensitive information on the same computer, within two completely isolated software environments, in order to avoid the risk of sensitive information leaking onto the public network. > Just don't. Please don't. You can have the most sane architecture, but there's a whole pile of s..tack underneath. You can't even trust a modern CPU. Wasn't it determined in 1974 that you can't successfully do that using conventionally developed software, even without the bloated modern "stack?" Multics Security Evaluation: Vulnerability Analysis: https://csrc.nist.gov/csrc/media/publications/conference-paper/1998/10/08/proceedings-of-the-21st-nissc-1998/documents/early-cs-papers/karg74.pdf https://csrc.nist.gov/csrc/media/publications/conference-pap... Thirty Years Later: Lessons from the Multics Security Evaluation: https://www.acsac.org/2002/papers/classic-multics.pdf https://www.acsac.org/2002/papers/classic-multics.pdf
- comboy 8y ago
  I'm gonna dive into those later, thank you. The way I see it, sensitive information should be offline. But you often need to access it in an automated manner. So set up a secure interface. Secure means that the protocol is minimalistic and you are monitoring unusual access patterns. E.g. serial interface with the sensitive data computer, where you only ask for X and it provides you X. Almost never you need to fetch all data at once. So you can set up some hourly limits or whatever. You can use microcontroller to validate data transmission. You can set up a hardware button if necessary. The beauty of it, is that the sensitive box could be running windows 3.11. The attack surface as minimal as it can be. When you have it on a computer that's connected to the Internet, in my eyes you already lost the game. I'm quite convinced it looks the same in the eyes of some 3 letter agencies, and it sure gets an average script kiddie excited.
michrassena 8y ago
I don't understand why it's deemed necessary to work with both public and sensitive information on the same device. This might have made sense when computers were much more expensive. Today, why not buy two computers and keep them physically isolated?
- devoply 8y ago
  The words network and sensitive information do not belong on the same computer. We can steal information from air gap-ed computers. Plug anything into a network and forget about any sort of security over the data.
  - luch 8y ago
    Well you know, security is a compromise. It's all about raising the bar for attackers while not penalizing too much regular users.
- brazzledazzle 8y ago
  Not defending it but based on descriptions I’ve heard about government air gapped networks I wonder if it’s less about cost of individual computers and more about the annoyance, overhead and expense of the transfer systems.
  - cakes 8y ago
    Yeah there is definitely annoyance, overhead, and expense but you are trying to securely transfer data to an air-gapped network so just "plugging things in" (what some people expect, like just grabbing a usb drive) is a risk in that regard so it's a lot of trade-offs.
  - Wohlf 8y ago
    This is a huge concern, if you spend any amount of time working in an airgapped environment this becomes painfully obvious.
- duxup 8y ago
  Yeah physical separation... seems like a large and ultimately good step. All the other efforts to logically separate things often have some sort of downside. I posted a while ago that there was a customer (tied to the military) that forbid ANY outside electronics of any type to enter their facility (main gate where you parked was ok, but you still turned everything over) without approval, and no electronics could ever leave. They went so far as to keep and presumably destroy anything that entered... bring a laptop, it's gone, be stupid and carry a phone, gone (nobody actually did the phone thing as you were warned plenty of times). Granted they paid a ton for it (for a laptop many times sometimes (other times they gave you one)) and it is mostly a policy only the military can be strict about. But having said that this was before smartphones and etc, and honestly now a days that seems like what was an extreme policy, is actually a good policy for many such places. We're already at the point where we know we can't be sure about declaring any equipment "clean". I was a little shocked to hear the White House was talking about banning smart phones in some places.... like how the hell haven't they done that already? A mic and camera on each person that wanders all over the world connecting to random cell towers and wi-fi and OMG, what a great attack vector!
brazzledazzle 8y ago
I wonder if there’s some context lost here with the term “sensitive”. I’ve seen data classifications use words like that. While “secret” and “ultra secret” is accurately described as “sensitive” or “confidential” the latter could be the names for distinct lower levels of data classification. So this might check enough security boxes to allow public data and the data classification tier immediately above that on the same box. That might be as innocuous as HR data or something that could be released to the public after redacting some personal information. Granted, my charitable speculation would require some inflexible or impractical data handling rules but I think a government bureaucracy could more than manage that.
- marmaduke 8y ago
  Working in IT for a few years in France, my guess is that this is a direct translation of a term (sensible) which refers to personally identifying information such as address or date of birth, and not some military secret. In this case, they want to provide some isolation but don’t expect to protect against ground breaking attacks like Spectre.
Cents 8y ago
"GOD MODE UNLOCKED - Hardware Backdoors in x86 CPUs" https://www.youtube.com/watch?v=_eSAF_qT_FY https://www.youtube.com/watch?v=_eSAF_qT_FY
epr 8y ago
Seriously... Anytime someone suggests that they have a "secure" piece of software without providing caveats relating to the inherent insecurity of every modern CPU and firmware stack based on closed-source proprietary blobs that the software will undoubtedly be running on it alerts to anyone with any meaningful understanding of the complexity of security that they are at best omitting crucially important information and at worst incompetent. Sure, the size and complexity of the Linux Kernel is a problem, but the crumbling foundation needs to be addressed before problems with the first floor.
- tbrock 8y ago
  I don’t think the goal of the software is to be hardened from all attacks from every angle. I think they are trying to prevent human error by compartmentalizing the system so they can work with sensitive data and avoid commingling it with public data.
  - dpwm 8y ago
    Also, the vast majority of breaches are due to this human error. Anything that attempts to mitigate that in one way or another is to be welcomed. From browsing the docs[0], CLIP OS looks like an interesting project. However, I do question how much of it is. One of the more interesting approaches using containerization in recent years is sandstorm.[0] It's unfortunate it wasn't a commercial success, because a lot of the ideas in there would go a long way to mitigating the majority of breaches that can occur at the userspace level. In sandstorm, web apps are containerised in a really minimal environment. Each app only has access to files it operates on. There is no procfs or sysfs. All communication with the outside world takes place through a unix socket that is opened by the supervisor.[2] [0] https://docs.clip-os.org/clipos/architecture.html https://docs.clip-os.org/clipos/architecture.html [1] https://sandstorm.io/ https://sandstorm.io/ [2] https://docs.sandstorm.io/en/latest/using/how-it-works/ https://docs.sandstorm.io/en/latest/using/how-it-works/

by comboy 8y ago

agumonkey 8y ago

worth a ticket on a bug tracker

ardy42 8y ago

>> It also provides partitioning mechanisms that make it possible to simultaneously process public and sensitive information on the same computer, within two completely isolated software environments, in order to avoid the risk of sensitive information leaking onto the public network. > Just don't. Please don't. You can have the most sane architecture, but there's a whole pile of s..tack underneath. You can't even trust a modern CPU. Wasn't it determined in 1974 that you can't successfully do that using conventionally developed software, even without the bloated modern "stack?" Multics Security Evaluation: Vulnerability Analysis: https://csrc.nist.gov/csrc/media/publications/conference-paper/1998/10/08/proceedings-of-the-21st-nissc-1998/documents/early-cs-papers/karg74.pdf https://csrc.nist.gov/csrc/media/publications/conference-pap... Thirty Years Later: Lessons from the Multics Security Evaluation: https://www.acsac.org/2002/papers/classic-multics.pdf https://www.acsac.org/2002/papers/classic-multics.pdf

comboy 8y ago
I'm gonna dive into those later, thank you. The way I see it, sensitive information should be offline. But you often need to access it in an automated manner. So set up a secure interface. Secure means that the protocol is minimalistic and you are monitoring unusual access patterns. E.g. serial interface with the sensitive data computer, where you only ask for X and it provides you X. Almost never you need to fetch all data at once. So you can set up some hourly limits or whatever. You can use microcontroller to validate data transmission. You can set up a hardware button if necessary. The beauty of it, is that the sensitive box could be running windows 3.11. The attack surface as minimal as it can be. When you have it on a computer that's connected to the Internet, in my eyes you already lost the game. I'm quite convinced it looks the same in the eyes of some 3 letter agencies, and it sure gets an average script kiddie excited.

michrassena 8y ago

I don't understand why it's deemed necessary to work with both public and sensitive information on the same device. This might have made sense when computers were much more expensive. Today, why not buy two computers and keep them physically isolated?

devoply 8y ago
The words network and sensitive information do not belong on the same computer. We can steal information from air gap-ed computers. Plug anything into a network and forget about any sort of security over the data.
- luch 8y ago
  Well you know, security is a compromise. It's all about raising the bar for attackers while not penalizing too much regular users.
brazzledazzle 8y ago
Not defending it but based on descriptions I’ve heard about government air gapped networks I wonder if it’s less about cost of individual computers and more about the annoyance, overhead and expense of the transfer systems.
- cakes 8y ago
  Yeah there is definitely annoyance, overhead, and expense but you are trying to securely transfer data to an air-gapped network so just "plugging things in" (what some people expect, like just grabbing a usb drive) is a risk in that regard so it's a lot of trade-offs.
- Wohlf 8y ago
  This is a huge concern, if you spend any amount of time working in an airgapped environment this becomes painfully obvious.
duxup 8y ago
Yeah physical separation... seems like a large and ultimately good step. All the other efforts to logically separate things often have some sort of downside. I posted a while ago that there was a customer (tied to the military) that forbid ANY outside electronics of any type to enter their facility (main gate where you parked was ok, but you still turned everything over) without approval, and no electronics could ever leave. They went so far as to keep and presumably destroy anything that entered... bring a laptop, it's gone, be stupid and carry a phone, gone (nobody actually did the phone thing as you were warned plenty of times). Granted they paid a ton for it (for a laptop many times sometimes (other times they gave you one)) and it is mostly a policy only the military can be strict about. But having said that this was before smartphones and etc, and honestly now a days that seems like what was an extreme policy, is actually a good policy for many such places. We're already at the point where we know we can't be sure about declaring any equipment "clean". I was a little shocked to hear the White House was talking about banning smart phones in some places.... like how the hell haven't they done that already? A mic and camera on each person that wanders all over the world connecting to random cell towers and wi-fi and OMG, what a great attack vector!

brazzledazzle 8y ago

I wonder if there’s some context lost here with the term “sensitive”. I’ve seen data classifications use words like that. While “secret” and “ultra secret” is accurately described as “sensitive” or “confidential” the latter could be the names for distinct lower levels of data classification. So this might check enough security boxes to allow public data and the data classification tier immediately above that on the same box. That might be as innocuous as HR data or something that could be released to the public after redacting some personal information. Granted, my charitable speculation would require some inflexible or impractical data handling rules but I think a government bureaucracy could more than manage that.

marmaduke 8y ago
Working in IT for a few years in France, my guess is that this is a direct translation of a term (sensible) which refers to personally identifying information such as address or date of birth, and not some military secret. In this case, they want to provide some isolation but don’t expect to protect against ground breaking attacks like Spectre.

Cents 8y ago

"GOD MODE UNLOCKED - Hardware Backdoors in x86 CPUs" https://www.youtube.com/watch?v=_eSAF_qT_FY https://www.youtube.com/watch?v=_eSAF_qT_FY

epr 8y ago

Seriously... Anytime someone suggests that they have a "secure" piece of software without providing caveats relating to the inherent insecurity of every modern CPU and firmware stack based on closed-source proprietary blobs that the software will undoubtedly be running on it alerts to anyone with any meaningful understanding of the complexity of security that they are at best omitting crucially important information and at worst incompetent. Sure, the size and complexity of the Linux Kernel is a problem, but the crumbling foundation needs to be addressed before problems with the first floor.

tbrock 8y ago
I don’t think the goal of the software is to be hardened from all attacks from every angle. I think they are trying to prevent human error by compartmentalizing the system so they can work with sensitive data and avoid commingling it with public data.
- dpwm 8y ago
  Also, the vast majority of breaches are due to this human error. Anything that attempts to mitigate that in one way or another is to be welcomed. From browsing the docs[0], CLIP OS looks like an interesting project. However, I do question how much of it is. One of the more interesting approaches using containerization in recent years is sandstorm.[0] It's unfortunate it wasn't a commercial success, because a lot of the ideas in there would go a long way to mitigating the majority of breaches that can occur at the userspace level. In sandstorm, web apps are containerised in a really minimal environment. Each app only has access to files it operates on. There is no procfs or sysfs. All communication with the outside world takes place through a unix socket that is opened by the supervisor.[2] [0] https://docs.clip-os.org/clipos/architecture.html https://docs.clip-os.org/clipos/architecture.html [1] https://sandstorm.io/ https://sandstorm.io/ [2] https://docs.sandstorm.io/en/latest/using/how-it-works/ https://docs.sandstorm.io/en/latest/using/how-it-works/