4 ms·
No mention of using an "air gap" in any of the comments here. Air-gapped networks are a pain to work with but are incredibly effective. I still haven't read an
by GSGBen 6y ago
No mention of using an "air gap" in any of the comments here.
Air-gapped networks are a pain to work with but are incredibly effective. I still haven't read anything on how the attackers actually reached the build server though, so it's hard to say if it would have worked in this specific case. I wonder if the lack of a clear statement of how they made the initial breach is due to
- bad searching on my part
- they still don't know
- they're still trying to mitigate it
- they're still trying to word it in a PR-approved way
- dublin 6y agoAn alternative to full air-gapping is gateways that pass only the traffic they're supposed to. One example: For many years before they were bought by HP, Compaq's mail system had a regular Internet-connected SMTP MTA that fed two back-to-back hardwired uucp MTAs that connected to another SMTP MTA that fed their internal network. This was the early days of the public Internet, and they didn't want to have to trust that their SMTP MTA was secure, so they just made sure nothing but mail could ever get through their mail pipeline. It's awkward and a bit of a pain to set up and manage, but enterprise companies have the resources to do things like that. And it did actually provide state-of-the-art email security for its time. (FWIW, I didn't work with Compaq, but compared notes with their network architect on an occasional basis...)