3 ms·

>I'm not sure anything can protect against a targeted attack from a nation-state. hardware airgap can go a long way

ciarannolan 6y ago
Didn't help Iran: https://en.wikipedia.org/wiki/Stuxnet https://en.wikipedia.org/wiki/Stuxnet
mike_d 6y ago
Airgaps protect against low to medium level attackers. Nation state tools for bypassing airgaps are a dime a dozen. One of the most common is interdiction of computers in shipping and installation of hardware implants.
- lawnchair_larry 6y ago
  This is not accurate at all.
- smithza 6y ago
  Airgaps are certainly intended to protect against every skill level hacker. The ideal strategy is the multi-layered, Swiss cheese approach. A slice for RBAC (LDAP, AD, MFA, etc.); a slice for email phishing filters and user awareness training; another for network segmentation and isolation (Firewalls, proxies); another for network filters (ping DDOS attacks, etc.); and on and on. The APT attack strategy uses every tool in the arsenal and hunts for a path through the cheese layers, hopefully never finding one to the real prize behind.
smithza 6y ago
Honestly, system user education/awareness goes even further. Iran nuclear facilities used an airgap but it was social engineering that was the weakest attack vector for Stuxnet to exploit. Same with the South Korean Winter Olympics; a phishing email with a macro embedded Word doc got them in there. A great book on Russian, state-backed hacking group was by a senior Wired writer, Andy Greenberg, called "Sandworm" [0] [0] https://www.amazon.com/Sandworm-Cyberwar-Kremlins-Dangerous-Hackers/dp/0525564632/ref=sr_1_1?dchild=1&keywords=sandworm+book&qid=1607471154&sr=8-1&tag=duc0c-20 https://www.amazon.com/Sandworm-Cyberwar-Kremlins-Dangerous-...
- deleted 6y ago
  [deleted]
AnimalMuppet 6y ago
How do you get updates to your airgapped hardware? That's your attack vector.
- forgotmypw17 6y ago
  you don't
  - AnimalMuppet 6y ago
    People do, if there's a bug fix. At least, some do.

Didn't help Iran: https://en.wikipedia.org/wiki/Stuxnet https://en.wikipedia.org/wiki/Stuxnet

Airgaps protect against low to medium level attackers. Nation state tools for bypassing airgaps are a dime a dozen. One of the most common is interdiction of computers in shipping and installation of hardware implants.

lawnchair_larry 6y ago
This is not accurate at all.
smithza 6y ago
Airgaps are certainly intended to protect against every skill level hacker. The ideal strategy is the multi-layered, Swiss cheese approach. A slice for RBAC (LDAP, AD, MFA, etc.); a slice for email phishing filters and user awareness training; another for network segmentation and isolation (Firewalls, proxies); another for network filters (ping DDOS attacks, etc.); and on and on. The APT attack strategy uses every tool in the arsenal and hunts for a path through the cheese layers, hopefully never finding one to the real prize behind.

smithza 6y ago

Honestly, system user education/awareness goes even further. Iran nuclear facilities used an airgap but it was social engineering that was the weakest attack vector for Stuxnet to exploit. Same with the South Korean Winter Olympics; a phishing email with a macro embedded Word doc got them in there. A great book on Russian, state-backed hacking group was by a senior Wired writer, Andy Greenberg, called "Sandworm" [0] [0] https://www.amazon.com/Sandworm-Cyberwar-Kremlins-Dangerous-Hackers/dp/0525564632/ref=sr_1_1?dchild=1&keywords=sandworm+book&qid=1607471154&sr=8-1&tag=duc0c-20 https://www.amazon.com/Sandworm-Cyberwar-Kremlins-Dangerous-...

deleted 6y ago
[deleted]

AnimalMuppet 6y ago

How do you get updates to your airgapped hardware? That's your attack vector.

forgotmypw17 6y ago
you don't
- AnimalMuppet 6y ago
  People do, if there's a bug fix. At least, some do.