3 ms·

Right. When you find a way to magically control the bits read from one hard drive and can ensure that same sequence of bits isn't "copied" and written to a diff

Right. When you find a way to magically control the bits read from one hard drive and can ensure that same sequence of bits isn't "copied" and written to a different storage medium... without a "second person".... well, you let me know. I guess with some right group policy settings, a TPM and BitLocker, you could get close maybe. Still going to be challenging to keep me from booting the machine, logging into it and catting that file... somewhere. Give me `wget` and a script and I could transmit data using only GETs.

fragsworth 13y ago
I think they mean that two people must be working together at all times whenever dealing with classified information. You can't even access your own work computer without another person present. It works. It's just extremely inefficient.
- jimbokun 13y ago
  Pair sys admining!
  - lsc 13y ago
    hey, I've done this with new people, and in cases where mistakes have a high cost... "Hey, new kid... come jump on my screen session" Of course, setting it up as a security measure would take rather more work.
- Amadou 13y ago
  Most systems will not have any sort of external media - no floppy drives, no removable hard disks, no cd burners. USB ports will be filled with epoxy and any peripherals will also be physically secured to their ports. Wherever possible drivers for external media will simply be removed from the OS installation image for those systems. That will leave a handful of system that do have external media. Those will have extreme access restrictions - at a minimum account restrictions and audit logs that will be regularly correlated with a hand-written log that contains timestamps and signatures of both people. They may even put the system in a room with keycard access that requires two different keycards and associated PINs to be entered before the door opens.
  - drivebyacct2 13y ago
    Are you speculating or speaking from experience? Either way, I'd like to imagine in these scenarios that the really, really secure stuff is kept offline or somehow on a non-Internet connected network.
    - Amadou 13y ago
      I am speaking from experience on non-NSA programs. It goes without saying that their entire operational network is firewalled with an air-gap. If a user needs to have internet (or other extranet) access from the same desk as their operational network, they will have an entirely separate terminal for it, they may even have rules that require a minimum distance between the two terminals.
gizmo686 13y ago
The NSA doesn't care at all if you copy the bits from there drives and publish them. What they care about is if you copy the content and publish that. With the right crypto, the bits would be indistinguishable from random data. There are well established crypto systems that requires any n keys to decrypt. Plug in n=2, and you have a crypto enforced 2 person policy. If you push decryption to the client (where it should be anyway, don't want plain text over the wires), then even with access to the data center, you cannot get the plaintext. What I don't think pure crypto can get you is a quota on how much an individual can access. Also, the fact that a single person can bypass whatever alarm systems they have means that if an external adversary gets root, they are undectable.
- drivebyacct2 13y ago
  > the implied means of power, the threat of force, rather than by direct military force Sure, right, that's kinda what I implied with my post. As long as I have access to decrypted bytes in memory and I have access to: my eyeballs + pen + paper, then the jig is up. The TPM+BitLocker scenario would protect the data on the hard disk and prevent offline attacks and would prevent someone from trying to extract the key from the running OS. > the implied means of power, the threat of force, rather than by direct military force Ding ding, exactly. That's why I mentioned "Group Policy". At best, you could attempt to restrict user access to the LIVE mounted decrypted data... but at that point you're trusting the client and a dedicated individual would get around it. You'd almost need this: Request remotely-stored invididual encrypted file -> Receive it locally -> Decrypt locally. which would give you a chokepoint to be able to cut off access to the encrypted data, but there are a thousand problems with this scenario as well, just from a technical standpoint.
  - gizmo686 13y ago
    >the implied means of power, the threat of force, rather than by direct military force What is this quote? >Request remotely-stored invididual encrypted file -> Receive it locally -> Decrypt locally. Is there any reason you wouldn't want to do it this way. Aside from the security benifits of having the data be in plain text for as little as possible (and eliminates a centralized point of failure), this also offloads CPU resources to the local computer, which is a win from a purely efficiency standpoint as well.

fragsworth 13y ago

I think they mean that two people must be working together at all times whenever dealing with classified information. You can't even access your own work computer without another person present. It works. It's just extremely inefficient.

jimbokun 13y ago
Pair sys admining!
- lsc 13y ago
  hey, I've done this with new people, and in cases where mistakes have a high cost... "Hey, new kid... come jump on my screen session" Of course, setting it up as a security measure would take rather more work.
Amadou 13y ago
Most systems will not have any sort of external media - no floppy drives, no removable hard disks, no cd burners. USB ports will be filled with epoxy and any peripherals will also be physically secured to their ports. Wherever possible drivers for external media will simply be removed from the OS installation image for those systems. That will leave a handful of system that do have external media. Those will have extreme access restrictions - at a minimum account restrictions and audit logs that will be regularly correlated with a hand-written log that contains timestamps and signatures of both people. They may even put the system in a room with keycard access that requires two different keycards and associated PINs to be entered before the door opens.
- drivebyacct2 13y ago
  Are you speculating or speaking from experience? Either way, I'd like to imagine in these scenarios that the really, really secure stuff is kept offline or somehow on a non-Internet connected network.
  - Amadou 13y ago
    I am speaking from experience on non-NSA programs. It goes without saying that their entire operational network is firewalled with an air-gap. If a user needs to have internet (or other extranet) access from the same desk as their operational network, they will have an entirely separate terminal for it, they may even have rules that require a minimum distance between the two terminals.

gizmo686 13y ago

The NSA doesn't care at all if you copy the bits from there drives and publish them. What they care about is if you copy the content and publish that. With the right crypto, the bits would be indistinguishable from random data. There are well established crypto systems that requires any n keys to decrypt. Plug in n=2, and you have a crypto enforced 2 person policy. If you push decryption to the client (where it should be anyway, don't want plain text over the wires), then even with access to the data center, you cannot get the plaintext. What I don't think pure crypto can get you is a quota on how much an individual can access. Also, the fact that a single person can bypass whatever alarm systems they have means that if an external adversary gets root, they are undectable.

drivebyacct2 13y ago
> the implied means of power, the threat of force, rather than by direct military force Sure, right, that's kinda what I implied with my post. As long as I have access to decrypted bytes in memory and I have access to: my eyeballs + pen + paper, then the jig is up. The TPM+BitLocker scenario would protect the data on the hard disk and prevent offline attacks and would prevent someone from trying to extract the key from the running OS. > the implied means of power, the threat of force, rather than by direct military force Ding ding, exactly. That's why I mentioned "Group Policy". At best, you could attempt to restrict user access to the LIVE mounted decrypted data... but at that point you're trusting the client and a dedicated individual would get around it. You'd almost need this: Request remotely-stored invididual encrypted file -> Receive it locally -> Decrypt locally. which would give you a chokepoint to be able to cut off access to the encrypted data, but there are a thousand problems with this scenario as well, just from a technical standpoint.
- gizmo686 13y ago
  >the implied means of power, the threat of force, rather than by direct military force What is this quote? >Request remotely-stored invididual encrypted file -> Receive it locally -> Decrypt locally. Is there any reason you wouldn't want to do it this way. Aside from the security benifits of having the data be in plain text for as little as possible (and eliminates a centralized point of failure), this also offloads CPU resources to the local computer, which is a win from a purely efficiency standpoint as well.