4 ms·

I don't understand why it's deemed necessary to work with both public and sensitive information on the same device. This might have made sense when computers w

I don't understand why it's deemed necessary to work with both public and sensitive information on the same device. This might have made sense when computers were much more expensive. Today, why not buy two computers and keep them physically isolated?

devoply 8y ago
The words network and sensitive information do not belong on the same computer. We can steal information from air gap-ed computers. Plug anything into a network and forget about any sort of security over the data.
- luch 8y ago
  Well you know, security is a compromise. It's all about raising the bar for attackers while not penalizing too much regular users.
brazzledazzle 8y ago
Not defending it but based on descriptions I’ve heard about government air gapped networks I wonder if it’s less about cost of individual computers and more about the annoyance, overhead and expense of the transfer systems.
- cakes 8y ago
  Yeah there is definitely annoyance, overhead, and expense but you are trying to securely transfer data to an air-gapped network so just "plugging things in" (what some people expect, like just grabbing a usb drive) is a risk in that regard so it's a lot of trade-offs.
- Wohlf 8y ago
  This is a huge concern, if you spend any amount of time working in an airgapped environment this becomes painfully obvious.
duxup 8y ago
Yeah physical separation... seems like a large and ultimately good step. All the other efforts to logically separate things often have some sort of downside. I posted a while ago that there was a customer (tied to the military) that forbid ANY outside electronics of any type to enter their facility (main gate where you parked was ok, but you still turned everything over) without approval, and no electronics could ever leave. They went so far as to keep and presumably destroy anything that entered... bring a laptop, it's gone, be stupid and carry a phone, gone (nobody actually did the phone thing as you were warned plenty of times). Granted they paid a ton for it (for a laptop many times sometimes (other times they gave you one)) and it is mostly a policy only the military can be strict about. But having said that this was before smartphones and etc, and honestly now a days that seems like what was an extreme policy, is actually a good policy for many such places. We're already at the point where we know we can't be sure about declaring any equipment "clean". I was a little shocked to hear the White House was talking about banning smart phones in some places.... like how the hell haven't they done that already? A mic and camera on each person that wanders all over the world connecting to random cell towers and wi-fi and OMG, what a great attack vector!
- mavhc 8y ago
  What happens now people have wireless devices keeping them alive, heart controllers etc?
  - vegardx 8y ago
    Probably nothing. The whole point is that electronic devices that can't be accounted for has to be kept back until they can be, or destroyed.
  - duxup 8y ago
    I don't recall anything in the policy that spoke to that. That's not a good answer, but it is all that I got. This wasn't a situation where you asked questions / got to.
- kakwa_ 8y ago
  I've heard a lot of stories regarding security and physical separation. The most funny was a repair guy from IBM or Cray in the 80ies or 90ies was tasked to repair a broken storage array in a super calculator doing some sensitive computation. He expected one of the disks to be dead (at the time those were quite expensive) and brought a new one. He plugged it and it was not that, the array was still KO. In the end it was a broken (and much cheaper) controller card. So he fixed it, and starting to going home. But the guards didn't let him go back with the expensive spare drive and the brand new drive had to be destroyed. There was some conflicts after that on whether or not the destroyed drive was part of the maintenance contract and who should pay for it (the government agency or the company doing the support and maintenance).
Wohlf 8y ago
I agree, but as someone who works on airgapped networks it effectively doubles (if not even more so) overhead and burden, and not only for infrastructure and administration but you end up duplicating and creating a lot more work for every person.
izacus 8y ago
Because if you don't, your workers will keep processing sensitive information on a public device because bringing data from one to the other is too tedious.
- michrassena 8y ago
  That's a personnel problem, not a technical problem.
  - seszett 8y ago
    A functional organisation has to take into account the fact that its personnel is made of humans, though.
  - reaperducer 8y ago
    It's still a problem.
  - izacus 8y ago
    Ignoring user behaviour makes any kind of security solution fundamentally flawed. Good security takes into account what people do and how they behave when they reach obstacles. Building your security solution in an ivory tower and then pushing on people will result in an utter failure - see PGP or password post-it notes on monitors.
    - michrassena 8y ago
      I agree that working with rather than against people's inclinations to reinforce security protocols is the best method. I'm a bit concerned that it's commonplace that people will route around those protocols in an environment where presumably the staff is all highly trained and disciplined.
      - palunon 8y ago
        This is intended to be use by the french administration (eg. the DMV), not intelligence agencies or the military. Sensitive in this context means nonpublic, not classified. (Administration in French would be the government in English - as in government shutdown, while government means administration in English - as in the Trump administration)
3pt14159 8y ago
To join OS data with TS data you need to somewhere. Though I've always said it should be a one-way / connectionless transfer of the OS data to the sensitive computer, with the human mind as the bridge to a connected machine. Thing is, we actually do this some places, but air gaps don't work. People say they do but they don't. Someone fucks up at some point. ASIC + no interfaces might work. But sensors are essentially interfaces, though they're much harder to exploit, and if you have no sensors and no interfaces then the device isn't going to be able to do anything useful.
- jeffrallen 8y ago
  You are talking about data diodes: https://www.owlcyberdefense.com/about-data-diodes https://www.owlcyberdefense.com/about-data-diodes
  - 3pt14159 8y ago
    Thanks. I knew about diodes, but I hadn't heard that there was an official term for what I've been describing. Edit: Interesting that these guys focus on fiber. It's also possible just by using UDP and cutting the return lines on an ethernet cable.
grive 8y ago
This is not a matter of cost or about whether enough machines are available and they might be shared. They have several attack scenarii, for which they need to provide countermeasures. They are listed here: https://docs.clip-os.org/clipos/security.html#threat-scenarios https://docs.clip-os.org/clipos/security.html#threat-scenari...

devoply 8y ago

The words network and sensitive information do not belong on the same computer. We can steal information from air gap-ed computers. Plug anything into a network and forget about any sort of security over the data.

luch 8y ago
Well you know, security is a compromise. It's all about raising the bar for attackers while not penalizing too much regular users.

brazzledazzle 8y ago

Not defending it but based on descriptions I’ve heard about government air gapped networks I wonder if it’s less about cost of individual computers and more about the annoyance, overhead and expense of the transfer systems.

cakes 8y ago
Yeah there is definitely annoyance, overhead, and expense but you are trying to securely transfer data to an air-gapped network so just "plugging things in" (what some people expect, like just grabbing a usb drive) is a risk in that regard so it's a lot of trade-offs.
Wohlf 8y ago
This is a huge concern, if you spend any amount of time working in an airgapped environment this becomes painfully obvious.

duxup 8y ago

Yeah physical separation... seems like a large and ultimately good step. All the other efforts to logically separate things often have some sort of downside. I posted a while ago that there was a customer (tied to the military) that forbid ANY outside electronics of any type to enter their facility (main gate where you parked was ok, but you still turned everything over) without approval, and no electronics could ever leave. They went so far as to keep and presumably destroy anything that entered... bring a laptop, it's gone, be stupid and carry a phone, gone (nobody actually did the phone thing as you were warned plenty of times). Granted they paid a ton for it (for a laptop many times sometimes (other times they gave you one)) and it is mostly a policy only the military can be strict about. But having said that this was before smartphones and etc, and honestly now a days that seems like what was an extreme policy, is actually a good policy for many such places. We're already at the point where we know we can't be sure about declaring any equipment "clean". I was a little shocked to hear the White House was talking about banning smart phones in some places.... like how the hell haven't they done that already? A mic and camera on each person that wanders all over the world connecting to random cell towers and wi-fi and OMG, what a great attack vector!

mavhc 8y ago
What happens now people have wireless devices keeping them alive, heart controllers etc?
- vegardx 8y ago
  Probably nothing. The whole point is that electronic devices that can't be accounted for has to be kept back until they can be, or destroyed.
- duxup 8y ago
  I don't recall anything in the policy that spoke to that. That's not a good answer, but it is all that I got. This wasn't a situation where you asked questions / got to.
kakwa_ 8y ago
I've heard a lot of stories regarding security and physical separation. The most funny was a repair guy from IBM or Cray in the 80ies or 90ies was tasked to repair a broken storage array in a super calculator doing some sensitive computation. He expected one of the disks to be dead (at the time those were quite expensive) and brought a new one. He plugged it and it was not that, the array was still KO. In the end it was a broken (and much cheaper) controller card. So he fixed it, and starting to going home. But the guards didn't let him go back with the expensive spare drive and the brand new drive had to be destroyed. There was some conflicts after that on whether or not the destroyed drive was part of the maintenance contract and who should pay for it (the government agency or the company doing the support and maintenance).

Wohlf 8y ago

I agree, but as someone who works on airgapped networks it effectively doubles (if not even more so) overhead and burden, and not only for infrastructure and administration but you end up duplicating and creating a lot more work for every person.

izacus 8y ago

Because if you don't, your workers will keep processing sensitive information on a public device because bringing data from one to the other is too tedious.

michrassena 8y ago
That's a personnel problem, not a technical problem.
- seszett 8y ago
  A functional organisation has to take into account the fact that its personnel is made of humans, though.
- reaperducer 8y ago
  It's still a problem.
- izacus 8y ago
  Ignoring user behaviour makes any kind of security solution fundamentally flawed. Good security takes into account what people do and how they behave when they reach obstacles. Building your security solution in an ivory tower and then pushing on people will result in an utter failure - see PGP or password post-it notes on monitors.
  - michrassena 8y ago
    I agree that working with rather than against people's inclinations to reinforce security protocols is the best method. I'm a bit concerned that it's commonplace that people will route around those protocols in an environment where presumably the staff is all highly trained and disciplined.
    - palunon 8y ago
      This is intended to be use by the french administration (eg. the DMV), not intelligence agencies or the military. Sensitive in this context means nonpublic, not classified. (Administration in French would be the government in English - as in government shutdown, while government means administration in English - as in the Trump administration)

3pt14159 8y ago

To join OS data with TS data you need to somewhere. Though I've always said it should be a one-way / connectionless transfer of the OS data to the sensitive computer, with the human mind as the bridge to a connected machine. Thing is, we actually do this some places, but air gaps don't work. People say they do but they don't. Someone fucks up at some point. ASIC + no interfaces might work. But sensors are essentially interfaces, though they're much harder to exploit, and if you have no sensors and no interfaces then the device isn't going to be able to do anything useful.

jeffrallen 8y ago
You are talking about data diodes: https://www.owlcyberdefense.com/about-data-diodes https://www.owlcyberdefense.com/about-data-diodes
- 3pt14159 8y ago
  Thanks. I knew about diodes, but I hadn't heard that there was an official term for what I've been describing. Edit: Interesting that these guys focus on fiber. It's also possible just by using UDP and cutting the return lines on an ethernet cable.

grive 8y ago

This is not a matter of cost or about whether enough machines are available and they might be shared. They have several attack scenarii, for which they need to provide countermeasures. They are listed here: https://docs.clip-os.org/clipos/security.html#threat-scenarios https://docs.clip-os.org/clipos/security.html#threat-scenari...