5 ms·

It has been the case for a long time that a proper "airgap" is not made out of just air but also electromagnetic and acoustic isolation. https://www.dni.gov/fi

It has been the case for a long time that a proper "airgap" is not made out of just air but also electromagnetic and acoustic isolation. https://www.dni.gov/files/NCSC/documents/Regulations/Technical-Specifications-SCIF-Construction.pdf https://www.dni.gov/files/NCSC/documents/Regulations/Technic...

bastardoperator 5y ago
Exactly. If we look at something like CIA headquarters it's a building in building with white noise being generated between the gaps for added security. Most people I deal with seem to think it means not having an internet connection which is true, but that's simply not enough.
- gonzo41 5y ago
  Maybe it is enough. What sort of market do you work in? And what sort of real attack is coming your way. An internet air-gap is probably enough for a vast majority of use cases. There's lots of talk about engineering here along the lines of "good engineering is knowing how to make a bridge barely stand up", but in Security, especially IT sec there's often little discussion about real risk and impact. And striking a reasonable balance. Places I've worked consider their product and information high security whilst embargoed (mostly financial). The IT security at these companies matched that posture. But people all drank together, shared everything over drinks and had terrible personal security. I'm not a security skeptic at all, I just think that the simple stuff goes a long way and that it's somewhat unhelpful to compare regular IT use to CIA style IT use.
  - NoPicklez 5y ago
    That's right, businesses should have security controls in place commensurate with the size and extent of its threats and vulnerabilities. It is not pragmatic for most organisations to spend enough money to implement the most protective security possible. Traditionally we call this determining your risk appetite. Overall, my experience from auditing the cyber security of many organisations is that they're not actually taking a risk based approach. They're not identifying their IT & Cyber Security risks and they're not identifying their specific threats and vulnerabilities. This leads to many organisations make poor security decisions by implementing technology controls that either aren't mitigating any of their risks or isn't reducing their residual risk to a comfortable level.
- dheera 5y ago
  > white noise being generated between the gaps Wouldn't that be easy to filter out because it's spectrally flat? Why don't they use millions of pre-recorded bogus and bait radio signals playing on all the commonly used frequencies instead?
  - mszcz 5y ago
    Wouldn't pre-recorded radio signals eventually loop and be easy to filter out?
MisterTea 5y ago
I even believe there is an attack which measures fluctuation in the AC current to the power supply. Might as well add power supply masking via a motor-generator set or inverter/on-line UPS that obfuscates/filters transients from the load to line.
- Kalium 5y ago
  Yup, power differential analysis are well-known enough to make their way into Wikipedia: https://en.wikipedia.org/wiki/Power_analysis#Power_analysis_and_algorithmic_security https://en.wikipedia.org/wiki/Power_analysis#Power_analysis_...
  - mmastrac 5y ago
    I recall high-speed light capture being used to exfiltrate data from router activity lights in the past. EDIT: link here: https://threatpost.com/blinking-router-leds-leak-data-from-air-gapped-networks/126199/ https://threatpost.com/blinking-router-leds-leak-data-from-a...
    - Scoundreller 5y ago
      That’s an easy one. There’s nothing different between blinking that status LED and sending a transmission over fibre and wiretapping that.
    - IIsi50MHz 5y ago
      Or highspeed cameras being used to discern the minute colour and luminance changes on a window or a material in the target room which occur due to vibrations in the glass or many other materials due to sound in the target room. This allows reproducing sound that occurs in the room without having access to any microphones. Or using appropiate lenses to "look through" blinds or other materials that have tiny lensing gaps which the typical person regards as not see-through.
      - toiletaccount 5y ago

bastardoperator 5y ago

Exactly. If we look at something like CIA headquarters it's a building in building with white noise being generated between the gaps for added security. Most people I deal with seem to think it means not having an internet connection which is true, but that's simply not enough.

gonzo41 5y ago
Maybe it is enough. What sort of market do you work in? And what sort of real attack is coming your way. An internet air-gap is probably enough for a vast majority of use cases. There's lots of talk about engineering here along the lines of "good engineering is knowing how to make a bridge barely stand up", but in Security, especially IT sec there's often little discussion about real risk and impact. And striking a reasonable balance. Places I've worked consider their product and information high security whilst embargoed (mostly financial). The IT security at these companies matched that posture. But people all drank together, shared everything over drinks and had terrible personal security. I'm not a security skeptic at all, I just think that the simple stuff goes a long way and that it's somewhat unhelpful to compare regular IT use to CIA style IT use.
- NoPicklez 5y ago
  That's right, businesses should have security controls in place commensurate with the size and extent of its threats and vulnerabilities. It is not pragmatic for most organisations to spend enough money to implement the most protective security possible. Traditionally we call this determining your risk appetite. Overall, my experience from auditing the cyber security of many organisations is that they're not actually taking a risk based approach. They're not identifying their IT & Cyber Security risks and they're not identifying their specific threats and vulnerabilities. This leads to many organisations make poor security decisions by implementing technology controls that either aren't mitigating any of their risks or isn't reducing their residual risk to a comfortable level.
dheera 5y ago
> white noise being generated between the gaps Wouldn't that be easy to filter out because it's spectrally flat? Why don't they use millions of pre-recorded bogus and bait radio signals playing on all the commonly used frequencies instead?
- mszcz 5y ago
  Wouldn't pre-recorded radio signals eventually loop and be easy to filter out?

MisterTea 5y ago

I even believe there is an attack which measures fluctuation in the AC current to the power supply. Might as well add power supply masking via a motor-generator set or inverter/on-line UPS that obfuscates/filters transients from the load to line.

Kalium 5y ago
Yup, power differential analysis are well-known enough to make their way into Wikipedia: https://en.wikipedia.org/wiki/Power_analysis#Power_analysis_and_algorithmic_security https://en.wikipedia.org/wiki/Power_analysis#Power_analysis_...
- mmastrac 5y ago
  I recall high-speed light capture being used to exfiltrate data from router activity lights in the past. EDIT: link here: https://threatpost.com/blinking-router-leds-leak-data-from-air-gapped-networks/126199/ https://threatpost.com/blinking-router-leds-leak-data-from-a...
  - Scoundreller 5y ago
    That’s an easy one. There’s nothing different between blinking that status LED and sending a transmission over fibre and wiretapping that.
  - IIsi50MHz 5y ago
    Or highspeed cameras being used to discern the minute colour and luminance changes on a window or a material in the target room which occur due to vibrations in the glass or many other materials due to sound in the target room. This allows reproducing sound that occurs in the room without having access to any microphones. Or using appropiate lenses to "look through" blinds or other materials that have tiny lensing gaps which the typical person regards as not see-through.
    - toiletaccount 5y ago