3 ms·

I’m curious to hear more about cases of large institutions seriously considering air-gapping. This is the first I’ve got wind of something like that.

by dcow 6y ago

lrem 6y ago
Yeah, runs contrary to my perception too. Even things that one would reasonably expect to be air-gapped are online these days.
bob1029 6y ago
Air-gapped systems really only make sense for the occasional need to access exceptionally sensitive materials. I.e. private keys for root CAs. For most businesses, air-gapping would mean we are back in the 20th century of business with filing cabinets and armies of people pushing paper between 2 rooms.
- edrxty 6y ago
  It's not actually that bad. There's a lot of defense, security, and highly proprietary development that happens on isolated networks. You have to put significant effort into IT infrastructure but you'll end up with all your stuff hosted internally and most tools support custom package repo mirrors (linux distros, programming languages/build systems, docker). You'll also probably have a second system with internet access at your desk if not nearby for stackoverflow et al. Basically the idea is defense in depth. The valuable stuff (design files, schematics, code, documentation) lives in the air gapped network while communications live inside a VPN and detailed technical discussion is often discouraged.
jffhn 6y ago
Air-gapping is common in some industries, and there are also network diodes: https://en.wikipedia.org/wiki/Unidirectional_network https://en.wikipedia.org/wiki/Unidirectional_network
thw0rted 6y ago
Keep in mind, there's actual air-gapping, and there's secure enclaves. This specific attack would have no teeth if your Exchange server / OWA endpoint were only accessible from corporate VPN. You don't have to be one of the top-ten biggest corporations to run a global-scale intranet with off-the-shelf VPN servers, and it still greatly reduces your attack surface.
koheripbal 6y ago
For us, that only makes sense for backups. ...maybe private keys?

I’m curious to hear more about cases of large institutions seriously considering air-gapping. This is the first I’ve got wind of something like that.

by dcow 6y ago

I’m curious to hear more about cases of large institutions seriously considering air-gapping. This is the first I’ve got wind of something like that.

lrem 6y ago

Yeah, runs contrary to my perception too. Even things that one would reasonably expect to be air-gapped are online these days.

bob1029 6y ago

Air-gapped systems really only make sense for the occasional need to access exceptionally sensitive materials. I.e. private keys for root CAs. For most businesses, air-gapping would mean we are back in the 20th century of business with filing cabinets and armies of people pushing paper between 2 rooms.

edrxty 6y ago
It's not actually that bad. There's a lot of defense, security, and highly proprietary development that happens on isolated networks. You have to put significant effort into IT infrastructure but you'll end up with all your stuff hosted internally and most tools support custom package repo mirrors (linux distros, programming languages/build systems, docker). You'll also probably have a second system with internet access at your desk if not nearby for stackoverflow et al. Basically the idea is defense in depth. The valuable stuff (design files, schematics, code, documentation) lives in the air gapped network while communications live inside a VPN and detailed technical discussion is often discouraged.

jffhn 6y ago

Air-gapping is common in some industries, and there are also network diodes: https://en.wikipedia.org/wiki/Unidirectional_network https://en.wikipedia.org/wiki/Unidirectional_network

thw0rted 6y ago

Keep in mind, there's actual air-gapping, and there's secure enclaves. This specific attack would have no teeth if your Exchange server / OWA endpoint were only accessible from corporate VPN. You don't have to be one of the top-ten biggest corporations to run a global-scale intranet with off-the-shelf VPN servers, and it still greatly reduces your attack surface.

koheripbal 6y ago

For us, that only makes sense for backups. ...maybe private keys?