3 ms·
If the purpose of the attack is to bring something into the network, to e.g. destroy something (Stuxnet), or blink an LED that faces a window, then RO media wil
by beAbU 2y ago
If the purpose of the attack is to bring something into the network, to e.g. destroy something (Stuxnet), or blink an LED that faces a window, then RO media will be pretty useless, and will probably cause a false sense of security.
- lucianbr 2y agoLikely that is the point. The initial process with the stick is security theater, and adding the RO requirement is just more theater. Both comments are sarcastic, imo.
- bflesch 2y agoThe read-only requirement makes sense because otherwise confidentiality of the airgapped system can be easily compromised (data extraction). If one's role is to only update AV on the airgapped machine then their data transfer to the airgapped machine should be only going into one direction.
- 1oooqooq 2y agoi think the joke requires knowledge that, if the exe is compromised, there's zero ways in hardware you can enforce read only mode on a USB stick, so it's probably done in software and is moot. and also, if it's air gapped, why even have an antivirus. ... for air borne ones?
- some_random 2y agoIt's incredibly easy to enforce read only on a USB stick when you destroy it after bringing it into a classified environment. As for antivirus, aren't we talking _right now_ about bringing potentially infected drives into an network?
- BlueTemplar 2y agoStill sounds like unnecessary risk when you can achieve it with a read-only CD drive.