3 ms·

>> It also provides partitioning mechanisms that make it possible to simultaneously process public and sensitive information on the same computer, within two co

by ardy42 8y ago

>> It also provides partitioning mechanisms that make it possible to simultaneously process public and sensitive information on the same computer, within two completely isolated software environments, in order to avoid the risk of sensitive information leaking onto the public network. > Just don't. Please don't. You can have the most sane architecture, but there's a whole pile of s..tack underneath. You can't even trust a modern CPU. Wasn't it determined in 1974 that you can't successfully do that using conventionally developed software, even without the bloated modern "stack?" Multics Security Evaluation: Vulnerability Analysis: https://csrc.nist.gov/csrc/media/publications/conference-paper/1998/10/08/proceedings-of-the-21st-nissc-1998/documents/early-cs-papers/karg74.pdf https://csrc.nist.gov/csrc/media/publications/conference-pap... Thirty Years Later: Lessons from the Multics Security Evaluation: https://www.acsac.org/2002/papers/classic-multics.pdf https://www.acsac.org/2002/papers/classic-multics.pdf

comboy 8y ago
I'm gonna dive into those later, thank you. The way I see it, sensitive information should be offline. But you often need to access it in an automated manner. So set up a secure interface. Secure means that the protocol is minimalistic and you are monitoring unusual access patterns. E.g. serial interface with the sensitive data computer, where you only ask for X and it provides you X. Almost never you need to fetch all data at once. So you can set up some hourly limits or whatever. You can use microcontroller to validate data transmission. You can set up a hardware button if necessary. The beauty of it, is that the sensitive box could be running windows 3.11. The attack surface as minimal as it can be. When you have it on a computer that's connected to the Internet, in my eyes you already lost the game. I'm quite convinced it looks the same in the eyes of some 3 letter agencies, and it sure gets an average script kiddie excited.

by ardy42 8y ago

comboy 8y ago

I'm gonna dive into those later, thank you. The way I see it, sensitive information should be offline. But you often need to access it in an automated manner. So set up a secure interface. Secure means that the protocol is minimalistic and you are monitoring unusual access patterns. E.g. serial interface with the sensitive data computer, where you only ask for X and it provides you X. Almost never you need to fetch all data at once. So you can set up some hourly limits or whatever. You can use microcontroller to validate data transmission. You can set up a hardware button if necessary. The beauty of it, is that the sensitive box could be running windows 3.11. The attack surface as minimal as it can be. When you have it on a computer that's connected to the Internet, in my eyes you already lost the game. I'm quite convinced it looks the same in the eyes of some 3 letter agencies, and it sure gets an average script kiddie excited.