5 ms·
I've not played in this space for a looong time but... There are four things you want to do - 1. Get a herd of cash together. The stuff that follows is not ch
by Spearchucker 13y ago
I've not played in this space for a looong time but...
There are four things you want to do -
1. Get a herd of cash together. The stuff that follows is not cheap.
2. Set up a hardware data diode (an appliance that only allows data to travel in one direction). [1]
3. Set up an air gap like Whale Comm's appliance used to do (two 1U rack-mount servers, back-to-back, which [dramatization alert] automates plugging a USB stick into one server, copying data onto it, pulling it out, sticking it into the other server, and coping the data onto it - at ~10Mb/s, if memory serves). [2]
4. Any time anything traverses the trust boundary, convert from one format to another, so PDF becomes RTF, DOC becomes TXT, PNG becomes GIF, and so on. The point is that converting attachments into other formats drops malicious payloads, or stops them from exploiting vulnerabilities in the apps that open the original formats.
[1] Tenix used to do one, but they cost crazy money (millions). I don't know much about this space anymore, but this might provide some pointers: http://en.wikipedia.org/wiki/Unidirectional_network http://en.wikipedia.org/wiki/Unidirectional_network
[2] Whale Communications was acquired by Microsoft. The product is now called ForeFront Unified Access Gateway, and while still a good application firewall, no longer provides that air gap (http://en.wikipedia.org/wiki/Microsoft_Forefront_Unified_Access_Gateway http://en.wikipedia.org/wiki/Microsoft_Forefront_Unified_Acc...). I've no idea who else can do this.
- sneak 13y agoIt seems like a wifi device in monitor mode might work for this. You could write a small utility to assemble streams from sequenced udp broadcast traffic or raw frames, and ensure the radio in the airgap machine never transmits.
- chockablock 13y ago> ensure the radio in the airgap machine never transmits How? Do any wifi devices use separate receive/xmit antennas? If not, then you are back to relying on software.
- pilom 13y agoNowadays the poor mans 1-way data diode is a fiber link with the bad transmit connector physically obstructed. So you're using fiber where transmit is on one fiber and receive is on the other but the receive is blocked. Then only use 1-way protocols (UDP).
- JoachimSchipper 13y agoMy employer (Fox-IT) sells a data diode (https://www.fox-it.com/en/products/datadiode/ https://www.fox-it.com/en/products/datadiode/). List price is "call us for a quote", but the quote won't be anywhere near $1 MM. Using a "proper" diode instead of hacking something yourself gets you a guaranteed-good solution - how much do you trust your firmware? - plus some software that automates "I want to send X through this machine" for many common and/or high-value instances of X. That said, custom hardware plus custom software plus certifications plus enterprise sales is indeed (a lot) more expensive than snipping the tx wire/fiber. Automatically copying USB sticks doesn't seem particularly useful to me.
- Spearchucker 13y agoThe air gap (copying data out of band, as it were) is useful in that the connection can be physically broken by software on the system high side, using a software kill switch, automated schedule or other rules.
- groby_b 13y agoUnless you need to transfer large amounts of data quickly, I'd suggest going back to the pleistocene of computing: Use RS232 in a two-wire config. (Data & Ground) Saves you about 1 million dollars ;)