Hacker News Reader

Hacker News

Comment by CJKinni | Hacker News Reader

Parent Full thread

CJKinni

What does it mean for something to be an "air-gapped commercial cloud"?

View on HN

https://en.wikipedia.org/wiki/Air_gap_(networking)

The "Top Secret" cloud is not connected to the Internet.

Which obviously can't be true or it would be inaccessible and thus utterly useless.

Why? It can still be connected to SIPRnet or JWICS.

Or customers can get a Direct Connect from their existing facilities into the region. I presume the USG has plenty of fiber straight into these new datacenters and I'm not sure why Amazon wouldn't allow Direct Connect.

As someone else mentioned, perhaps this will get contractors to stop using public S3 buckets to share data.

That’s not “air gapped” if it’s connected to another government network.

It's air-gapped from the Internet.

The term “air gap” does not directly imply anything to do with the Internet (doesn’t exclude it, but it applies more generally than specific networks). Yes, IC uses it to signify high/low networks, but the original usage of the term was to indicate a machine with no direct connection to the outside world. The theory being (since proven wrong), you can’t exfiltrate data remotely from a device not connected to a network.

What if it’s submerged in coolant?

JWICS/SIPR/NSAnet/etc. are air gapped in that terminals are not allowed to be dual homed to any other network or to each other.

Yes, I know the inteligence community uses this definition of air gap to signify the barrier between high/low networks, but I kinda feel it misses the point of the term. If it is networked to the outside world, even securely, I feel it kinda misses the point of the “air gap” connotation (aka requiring a “sneaker net” to get data in / out). I’m likely being pedantic though, so I upvoted you as you at least gave a good response unlike others.

It’s useful insofar as it’s connected to itself, allowing individuals and companies to share data and compute with one-another, where data can ingress/egress manually but travel the network between VPCs automatically.

It might also mean that the cloud is connected to networks that are not, themselves, Internet-routed. For example, users of the Secret region might have leased lines connecting airgapped computers in their own facilities directly to the DC for ingress/egress.

It might also mean that the network is connected to a “different Internet”, like MILNET.

inaccessible for whom? the public internet isn't the only (inter)network that exists.

They likely connect via encrypted leased lines.

It's probably connected only to the us government secret network (I forget the acronym) and not the public internet.

The contracted top secret cloud is connected to JWICS. JWICS and SIPRnet (the secret counterpart) are both government internets (but are not the Internet with a capital I).

They have a robot constantly hot-swapping disks between racks maybe?

I know of two government approved methods for data transfers for closed networks, one of which is pretty close. You basically have two servers connected to the same disk array, and they take turns mounting it to move files onto/off it. There is of course scanning and logging and such involved.

The other (unidirectional) method is a fibre pair connection that does not physically connect the TX with the RX in one direction, and there is some bumblefuckery that pushes the data through.

Of course classified data is only transferred from networks with lower classification to networks with higher classification, never the other way.

See Raytheon “High Speed Guard” description:

PDF: https://www.raytheon.com/capabilities/rtnwcm/groups/gallery/...

From PR:

Raytheon Trusted Computer Solutions (RTCS), a wholly owned subsidiary of Raytheon Company (NYSE: RTN), today announced that its High Speed Guard (HSG) big data transfer solution has received Cross Domain System Authorization and Authority to Operate for Secret and Below Interoperability (SABI).

This allows government customers to connect to networks classified at secret and below, and enables them to start the SABI site test and evaluation toward full system accreditation.

Raytheon's HSG solution is a commercial-off-the-shelf product that enables the rapid transfer of all types of data across multiple networks at different classification levels. With the industry's fastest bi-directional transfer rates of any guard technology and proven sustained transfer rates of more than nine gigabits per second, HSG is ideally suited for large-scale deployments that require rapid, automated data transfer.

> bumblefuckery

That is precisely how I would describe the Tenix and/or FOX-IT data pump implementations. It's amazing what people can manage to get away with even at EAL-7+.

Fun fact: many desktop printers can hit 3kbps in V40L QR codes (biggest + lowest ECC).

(Estimated at approx 10ppm by 20KiB per code.)

For the security conscious on a budget, printing QR codes to scan to a networked machine can be a way to get information off an otherwise air-gapped machine, with easy introspection and auditing. (This came up in the context of offline signing of Bitcoin transactions with a "warm" wallet -- digital, but airgapped from the "hot" wallets.)

Reply on news.ycombinator.com