Hacker News Reader

Comment by michrassena | Hacker News Reader

I don't understand why it's deemed necessary to work with both public and sensitive information on the same device. This might have made sense when computers were much more expensive. Today, why not buy two computers and keep them physically isolated?

View on HN

Yeah physical separation... seems like a large and ultimately good step. All the other efforts to logically separate things often have some sort of downside.

I posted a while ago that there was a customer (tied to the military) that forbid ANY outside electronics of any type to enter their facility (main gate where you parked was ok, but you still turned everything over) without approval, and no electronics could ever leave. They went so far as to keep and presumably destroy anything that entered... bring a laptop, it's gone, be stupid and carry a phone, gone (nobody actually did the phone thing as you were warned plenty of times).

Granted they paid a ton for it (for a laptop many times sometimes (other times they gave you one)) and it is mostly a policy only the military can be strict about.

But having said that this was before smartphones and etc, and honestly now a days that seems like what was an extreme policy, is actually a good policy for many such places. We're already at the point where we know we can't be sure about declaring any equipment "clean".

I was a little shocked to hear the White House was talking about banning smart phones in some places.... like how the hell haven't they done that already? A mic and camera on each person that wanders all over the world connecting to random cell towers and wi-fi and OMG, what a great attack vector!

I've heard a lot of stories regarding security and physical separation.

The most funny was a repair guy from IBM or Cray in the 80ies or 90ies was tasked to repair a broken storage array in a super calculator doing some sensitive computation.

He expected one of the disks to be dead (at the time those were quite expensive) and brought a new one.

He plugged it and it was not that, the array was still KO. In the end it was a broken (and much cheaper) controller card. So he fixed it, and starting to going home. But the guards didn't let him go back with the expensive spare drive and the brand new drive had to be destroyed.

There was some conflicts after that on whether or not the destroyed drive was part of the maintenance contract and who should pay for it (the government agency or the company doing the support and maintenance).

Yeah that's pretty common today even at a lot of places, no hard drives leave the premises.

Generally though there's not much to be confused about in my experience, it is typically in the contract. When I went onsite if they demanded the equipment for security reasons I just handed it over... you'd be surprised how often security guy or IT security guy suddenly doesn't like being responsible for some cards or such and lets you go ;)

What happens now people have wireless devices keeping them alive, heart controllers etc?

I don't recall anything in the policy that spoke to that. That's not a good answer, but it is all that I got. This wasn't a situation where you asked questions / got to.

Probably nothing.

The whole point is that electronic devices that can't be accounted for has to be kept back until they can be, or destroyed.

Because if you don't, your workers will keep processing sensitive information on a public device because bringing data from one to the other is too tedious.

That's a personnel problem, not a technical problem.

Ignoring user behaviour makes any kind of security solution fundamentally flawed. Good security takes into account what people do and how they behave when they reach obstacles.

Building your security solution in an ivory tower and then pushing on people will result in an utter failure - see PGP or password post-it notes on monitors.

I agree that working with rather than against people's inclinations to reinforce security protocols is the best method. I'm a bit concerned that it's commonplace that people will route around those protocols in an environment where presumably the staff is all highly trained and disciplined.

This is intended to be use by the french administration (eg. the DMV), not intelligence agencies or the military. Sensitive in this context means nonpublic, not classified.

(Administration in French would be the government in English - as in government shutdown, while government means administration in English - as in the Trump administration)

This is a great point. I tried to push use of SSH keys only to have see people put them in Dropbox or send the private key by email.

A functional organisation has to take into account the fact that its personnel is made of humans, though.

It's still a problem.

This is not a matter of cost or about whether enough machines are available and they might be shared.

They have several attack scenarii, for which they need to provide countermeasures.

They are listed here: https://docs.clip-os.org/clipos/security.html#threat-scenari...

Not defending it but based on descriptions I’ve heard about government air gapped networks I wonder if it’s less about cost of individual computers and more about the annoyance, overhead and expense of the transfer systems.

Yeah there is definitely annoyance, overhead, and expense but you are trying to securely transfer data to an air-gapped network so just "plugging things in" (what some people expect, like just grabbing a usb drive) is a risk in that regard so it's a lot of trade-offs.

This is a huge concern, if you spend any amount of time working in an airgapped environment this becomes painfully obvious.

To join OS data with TS data you need to somewhere.

Though I've always said it should be a one-way / connectionless transfer of the OS data to the sensitive computer, with the human mind as the bridge to a connected machine. Thing is, we actually do this some places, but air gaps don't work. People say they do but they don't. Someone fucks up at some point.

ASIC + no interfaces might work. But sensors are essentially interfaces, though they're much harder to exploit, and if you have no sensors and no interfaces then the device isn't going to be able to do anything useful.

You are talking about data diodes: https://www.owlcyberdefense.com/about-data-diodes

Thanks. I knew about diodes, but I hadn't heard that there was an official term for what I've been describing.

Edit: Interesting that these guys focus on fiber. It's also possible just by using UDP and cutting the return lines on an ethernet cable.

The words network and sensitive information do not belong on the same computer. We can steal information from air gap-ed computers. Plug anything into a network and forget about any sort of security over the data.

Well you know, security is a compromise. It's all about raising the bar for attackers while not penalizing too much regular users.

I agree, but as someone who works on airgapped networks it effectively doubles (if not even more so) overhead and burden, and not only for infrastructure and administration but you end up duplicating and creating a lot more work for every person.

Reply on news.ycombinator.com