2 ms·

For an airgap lab, refer to the principal of Faraday Cage as a guideline. For tighter control of reduced attack surface: - libmusl instead of glibc - pre-

For an airgap lab, refer to the principal of Faraday Cage as a guideline. For tighter control of reduced attack surface: - libmusl instead of glibc - pre-2013 CPU - no UEFI - no Management Engine (ME) - replace BIOS with an open-source variety - disable Write-Execute (relegate JIT to emulated VM; that’s web browsers too) For an IT cybersecurity coordinator to have an hypothetical secured homeLAN system, he/she would need to set up: - a RADIUS server - a LDAP server - an encrypted MAC layer via PKI - a default-deny firewall (absolutely no VPN/DNSm/DoH/DoT pinholes) - a transparent HTTPS proxy server with various ICAP servers scrubbing bad things - a waterfall router (randomized packet jitters) - a bastion DNS resolver - internal authoritative DNSSEC servers (including cloned Root servers) - personalized workstations run on QubeOS - test workstations on pre-prepared hardened OS - VM servers run in strict software-emulated mode. - disable JavaScript on all hosts’ OSes (guest VM and guestnet could have ‘em) - VMs can only run Whonix Linux OS - an intensive alerting system via heavily-sanitized SMS and email (but no public-facing, like Twitter) and that is not counting any external servers needed to support the initial homeNET setup. You want VPN or exit-only Tor node, buy a cheap WireGuard’d VPS. of course, then there is so many more security enhancements for Linux, on top of SELinux, Toyo, GRSecurity mostly in form of Linux kernel configuration tweaking. Isn’t job security awesome? # Reference # * https://github.com/a13xp0p0v/linux-kernel-defence-map/blob/master/linux-kernel-defence-map.svg https://github.com/a13xp0p0v/linux-kernel-defence-map/blob/m... * https://en.wikipedia.org/wiki/IEEE_802.1X https://en.wikipedia.org/wiki/IEEE_802.1X * https://en.wikipedia.org/wiki/Wi-Fi_6 https://en.wikipedia.org/wiki/Wi-Fi_6 * https://alternativeto.net/software/libreboot/ https://alternativeto.net/software/libreboot/ * https://www.kicksecure.com/ https://www.kicksecure.com/ * https://www.whonix.org/ https://www.whonix.org/ * https://wiki.archlinux.org/title/kernel_parameters https://wiki.archlinux.org/title/kernel_parameters

egberts1 4y ago
And a bunch of kernel patches to: * disable access to various /proc/sys that reveal various kernel addresses * randomize TCP ICN * disable hibernate/sleep * no container, Docker, LXR, nor KVM support; just the QEMU without direct machine code execute. That’s is just scratching the surface.

egberts1 4y ago

And a bunch of kernel patches to: * disable access to various /proc/sys that reveal various kernel addresses * randomize TCP ICN * disable hibernate/sleep * no container, Docker, LXR, nor KVM support; just the QEMU without direct machine code execute. That’s is just scratching the surface.