4 ms·

I'm a security guy and I've worked in these kinds of environments and it really sucked. These days whenever someone proposes creating an air gapped network for

by arkem 12y ago

I'm a security guy and I've worked in these kinds of environments and it really sucked. These days whenever someone proposes creating an air gapped network for a secret project I spend a lot of time enumerating the extreme costs of this configuration. Some of these costs are lowered development productivity, additional hardware and the extra people required for the more intense monitoring. Air gapped networks are unpleasant to work on but can be a good security mechanism if you truly appreciate the costs.

bane 12y ago
Yeah, it's a classic risk/cost assessment. You can weigh what a scheme like this costs to implement vs. how valuable your information is and make a decision. I think it's a good idea for some places to do this, but not all. It really depends.
- logfromblammo 12y ago
  I once worked on an air-gapped network. I programmed my own Klondike Solitaire, Freecell Solitaire, and Hunt the Wumpus games. The project was named "LBus", which was short for "look busy". I made the user interface look like log entries in a console window. That's why perimeter defense doesn't work. You always have to let at least one person in, and any person you let in can become an insider threat--especially if their job is to write source code, compile it, and run it. If I need a script or simple program, I wouldn't bother trying to clear someone else's through security if it were easier to just type it in myself. I feel slightly bad about slacking off at work in that manner, but I still completed all the tasks that were expected of me, and even got actual cash bonuses for exceeding work expectations. That workplace had absolutely no mechanism in place for exercising ambition or creativity, so if that entire department hadn't been destroyed by unethical (and, as I later learned, illegal) contracting practices, I probably would have also eventually devised a way to make Tetris look like the TPS Reports. It wasn't the worst job ever. But yes, internal security is a must. At minimum, keep the overly clever people with access to compilers in their own sandbox, away from everyone else. It seems odd to tell someone they can't have a compiled binary when they can just sit at a keyboard and type in "int main (void){ while(1) fork(); }" just for giggles. It's like giving someone a .50-cal rifle and then denying them a 9mm pistol. It is an actual security issue, but really, as a developer, I just want different security restrictions on me than the non-developer users. I have a compiler and the ability to execute any code I can imagine. In what network would you not want to wall me off from everyone else?
  - walterbell 12y ago
    VPNs can be used on the internal network to separate Dev & Production systems. This works best with strong endpoint isolation. Qubes has a paper on physical vs. software isolation, http://www.invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf http://www.invisiblethingslab.com/resources/2014/Software_co...

by arkem 12y ago

bane 12y ago

Yeah, it's a classic risk/cost assessment. You can weigh what a scheme like this costs to implement vs. how valuable your information is and make a decision. I think it's a good idea for some places to do this, but not all. It really depends.

logfromblammo 12y ago
I once worked on an air-gapped network. I programmed my own Klondike Solitaire, Freecell Solitaire, and Hunt the Wumpus games. The project was named "LBus", which was short for "look busy". I made the user interface look like log entries in a console window. That's why perimeter defense doesn't work. You always have to let at least one person in, and any person you let in can become an insider threat--especially if their job is to write source code, compile it, and run it. If I need a script or simple program, I wouldn't bother trying to clear someone else's through security if it were easier to just type it in myself. I feel slightly bad about slacking off at work in that manner, but I still completed all the tasks that were expected of me, and even got actual cash bonuses for exceeding work expectations. That workplace had absolutely no mechanism in place for exercising ambition or creativity, so if that entire department hadn't been destroyed by unethical (and, as I later learned, illegal) contracting practices, I probably would have also eventually devised a way to make Tetris look like the TPS Reports. It wasn't the worst job ever. But yes, internal security is a must. At minimum, keep the overly clever people with access to compilers in their own sandbox, away from everyone else. It seems odd to tell someone they can't have a compiled binary when they can just sit at a keyboard and type in "int main (void){ while(1) fork(); }" just for giggles. It's like giving someone a .50-cal rifle and then denying them a 9mm pistol. It is an actual security issue, but really, as a developer, I just want different security restrictions on me than the non-developer users. I have a compiler and the ability to execute any code I can imagine. In what network would you not want to wall me off from everyone else?
- walterbell 12y ago
  VPNs can be used on the internal network to separate Dev & Production systems. This works best with strong endpoint isolation. Qubes has a paper on physical vs. software isolation, http://www.invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf http://www.invisiblethingslab.com/resources/2014/Software_co...