Ask HN: Would you implement security setup for three letter agencies | Hacker News Reader

Ask HN: Would you implement security setup for three letter agencies

15 pointsmarkus_zhang24 comments

Hi experts,

How would you implement computer security configuration for intelligence agencies?

What OS to use?

Airgap and VPN in/out both ways?

I would make heavy use of old known technologies.

Set up Red and Blue teams to keep everyone else honest. Enpower an inspector general to make sure corruption is kept at bay.

Build highly controlled and audited sources of high quality random bits, well isolated from all other computing infrastructure. Generate one time pads at the rate of terabytes per day for physical distribution in tightly logged and controlled distributions.

Centralization and tight onsite audited management of sensitive data in air-gapped environments.

Data ingress only allowed in tightly controlled formats (to prevent ingress of control), via data diodes.

All bulk data outgress to use one time pads. All other access through deliberately low bandwidth channels with multiple logging platforms to prevent exfiltration.

Heavy use of append only filesystems. All data at rest to be cryptographically check summed and verified on a regular basis.

I work infosec so my question would what computer? Server? Lab workstation? Kiosk?

Hardened windows 10/11 or Macos. My threat model will be for persistent threat actors so aside from hardening, I will collect a ton of edr and network data and couple it with purpleteaming+threathunting.

Believe it or not windows can be locked down tight and macos can get pwned easily as well.

I will of course ban email as first order business unless you have an exemption and you don't access a secure network. Basically what they do now by having a separate dedicated machine for accesing a secure network with usb ports soldered off. Admins will use MS recommended privileged access workstations for admin activity which is separate by policy from secure and insecure workstations.

No layer 3 lan traffic. Each workstation gets a routed vlan , restricts traffic on the host and router acl to an internal vpn terminator that will also act as a firewall to implement MAC to resources. EAP-TLS where required.

Secure network is not connected to any other network but not airgapped either. Airgapping is for data storage/processing dedicated nodes not user workstations.

What they do now with smartcards sounds good for logins.

JEA, Cred guard, wdac whitelisting, blah blah hardening like I said before but hardening is the start as is "all patches are emergency patches". Detection, Detection ,Detection (includes both types of hunts); shut up and give me all your logs. TLS decryption and packet capture device on every router interface (netwitness?).

Of course Top secret//SC, codeword clearance and above will never touch a computer and Printers, came, iot,etc... will also be monitored very closely and hardened even with segregation. Of course you can't take a secure computer off premises and insecure computers get wiped if they stay off prem too long and are all subject for quarterly firmware and hardware integrity inspection just like secure computers. No builtin cams or mics on any computer period.

I am sure I missed a lot but for workstations this comes to mind. Servers, cloud, mobile are a whole other beast.

Thanks, I definitely know little about security but this reminds me of something I read about Huawei:

Basically there are periods when they are developing a top secret product. Every developer eats/sleeps/devs wothin a closed compound. They don't have cellphones and every computer has its USB ports sealed. There are other measures but I only remember it's airgapped. If a developer needs something he can logon a computer which has access to public internet.

Just curious how do you harden Windows?

ASR rules, process mitigation policies, DoD stig [1] implementation. And on top of that a bunch other registry keys and settings that are too arbitrary and many to list here

[1] https://public.cyber.mil/announcement/stig-update-disa-relea...

Thanks for sharing~~

Why Windows I’m place of Linux, I am curious?!

Use nothing newer than 30 years old. Sell it to the customer as secure and proven; lay traps on a few of the glaring well known holes to keep them amused and happy.

Sell it to anarchist buddies as ensuring that these evil arms of government oppression are shackled by the antiquated systems. Reap rewards of regard for helping subvert the effectiveness of the authoritarian State.

Sell it to authoritarian buddies as elegant, focused, and effective systems that help filter out people not truly committed to the Mission. Enjoy the recognition of a faithful Enabler of Order.

I'm not sure all their OS are Linux 1.0...

lol ... a true salesman's perspective.

Inside HQ: dumb terminal PC's (not laptops) using latest Windows* with all the patches, monitoring and BigBrother tracking of activity. All input ports (USB, lightning, whatever) on the PC are disabled, except for mouse/keyboard.

Probably a pretty complex network topology where specific Ethernet ports/terminals have access to specific networks/applications for the most sensitive things. MAC address from the NIC is part of the authentication in addition to user login/2FA. Physical security to those rooms with keycard plus biometric access. Apply this concept to varying degrees appropriately for each system/team/room. Similarly complex application permissions/security would be needed as well.

* Why Windows? PCs are cheap, after all this is the government we're dealing with here. If they are dumb terminals to apps then they are even cheaper when ordering thousands of them. And the gov wants easy support/training so Linux is likely a non-starter with non-tech people. They're not going to spend $1200+ on Apple laptops per person either.

By reaching out to a few people I know who are far more competent than I am.

Are you responding to a tender? U usually dont get much of a choice, you would comply with the relevant regulations for the security level of the network you are building for.

No just curious as laymen don't get to see what happens in agencies. Although I'd assume large corporations esoecially defense to take similar routes.

At a previous company we were using Windows server images from the NSA, a helpful secure build no doubt.

With intentional backdoors because fuck Western imperialism and the military industrial complex.

Or at least that's what I'd tell myself, with a wry grin on my face and RATM playing in my head until they caught on to my obvious shenanigans and black-bagged me.

Regular ones you use, just like how you'd treat an enterprise client, nothing fancy.

The hardest parts in these kind of projects is educating their staff and discovering the edge cases before they get shipped out.

For a while the NSA was using OpenStack + CentOS + SELinux in at least some environments. I have no idea if they are still using the hardcore bare-bones SELinux that does not have targeted (MLS-only) and unconfined policies. I'd buy them a few rounds of drinks if they are still subjecting themselves to that. I also have no idea if they are still using CentOS after CentOS-8 Stream happened. I believe their focus was compartmentalization, documentation and strict change control.

I have no idea what the CIA is using.

What I would do is probably something similar to what the NSA is/was doing and include multiple certified 3rd party code reviewers and penetration testers that would not just look for bugs and vulnerabilities but also vulnerable platform concepts, i.e. anything that lends itself to Instrumental Convergence [1]. I would ensure all hardware is using CoreBoot BIOS/firmware and have teams pentest that code. I would hire teams of document writers to ensure everything is documented and has the correct security classification annotations. I would also hire investigation firms to look into everyone that has ever contributed code to OpenStack and RHEL/CentOS. I would require IBM/Redhat to de-obfuscate any obfuscated code and use an NSL to order them to provide technical details on any undocumented weaknesses or intentional lawful intercept code. I would have them also contribute to the upstream kernel more sysctl and /sys tunables that can improve anti-tampering and prevent changing capabilities on the fly. I would also use NSL's to get the firmware of all hardware in the servers. Any applications used by the organization would also have to be retrofitted with instrumentation that can be monitored real time by machine learning to determine if anything suspect is afoot. The monitoring would use short dictionary coded signals vs. verbose English to reduce transmission time, being entirely documented in the man pages.

I would ensure that change control while strict would also be semi-agile in that one could make changes quickly if they, their supervisors and their peer reviewers have the appropriate security clearances. Their security clearance would map to one or more security levels and categories in SELinux. If they are DENIED then security guards would rush into the room with cans of silly string, assuming that is still a thing.

I would repeat the entire process non stop and ensure any fixes are implemented up-stream so that all businesses may also benefit from improvements and full transparency.

There are many more things that would have to be done but I don't think even a summary would fit on HN.

[1] - https://en.wikipedia.org/wiki/Instrumental_convergence

Thanks, interesting. I'm not a heavy Linux user and never heard about SELinux. I'll take a look and see why it was chosen. What I also see is that NSA makes a lot of their own tools such as Ghidra so I'm wondering maybe they are also building their own Linux?

SElinux is one of the 4 or so security modules in the Linux kernel. Examples are SELinux, Smack, Tomoyo, and AppArmor. There is also a "capabilities" security module that can be used in conjunction with the aforementioned modules. Each distribution will have a preferable default security module.

To my knowledge the NSA have not rolled their own Linux distribution, but they were the folks that initially created SELinux to meet their needs for a mandatory access control system that has parity to their security clearance structure. Redhat then modified it to make it easier to use by adding concepts such as "unconfined" users and types as well as targeted policies, meaning that if it does not match a rule, it is not enforced. Even with the changes implemented by Redhat many people still disable SELinux rather than making rules to fit all of their custom deployments.

Hi @dang can you please add "How" before the title, thanks!

always hilarious when it gets removed

For an airgap lab, refer to the principal of Faraday Cage as a guideline.

For tighter control of reduced attack surface:

  - libmusl instead of glibc
  - pre-2013 CPU
  - no UEFI
  - no Management Engine (ME)
  - replace BIOS with an open-source variety
  - disable Write-Execute (relegate JIT to emulated VM; that’s web browsers too)

For an IT cybersecurity coordinator to have an hypothetical secured homeLAN system, he/she would need to set up:

  - a RADIUS server
  - a LDAP server
  - an encrypted MAC layer via PKI
  - a default-deny firewall (absolutely no VPN/DNSm/DoH/DoT pinholes)
  - a transparent HTTPS proxy server with various ICAP servers scrubbing bad things
  - a waterfall router (randomized packet jitters)
  - a bastion DNS resolver
  - internal authoritative DNSSEC servers (including cloned Root servers)
  - personalized workstations run on QubeOS
  - test workstations on pre-prepared hardened OS
  - VM servers run in strict software-emulated mode. 
  - disable JavaScript on all hosts’ OSes (guest VM and guestnet could have ‘em)
  - VMs can only run Whonix Linux OS
  - an intensive alerting system via heavily-sanitized SMS and email (but no public-facing, like Twitter)

and that is not counting any external servers needed to support the initial homeNET setup. You want VPN or exit-only Tor node, buy a cheap WireGuard’d VPS.

of course, then there is so many more security enhancements for Linux, on top of SELinux, Toyo, GRSecurity mostly in form of Linux kernel configuration tweaking.

Isn’t job security awesome?

# Reference #

* https://github.com/a13xp0p0v/linux-kernel-defence-map/blob/m...

* https://en.wikipedia.org/wiki/IEEE_802.1X

* https://en.wikipedia.org/wiki/Wi-Fi_6

* https://alternativeto.net/software/libreboot/

* https://www.kicksecure.com/

* https://www.whonix.org/

* https://wiki.archlinux.org/title/kernel_parameters

And a bunch of kernel patches to:

* disable access to various /proc/sys that reveal various kernel addresses * randomize TCP ICN

* disable hibernate/sleep

* no container, Docker, LXR, nor KVM support; just the QEMU without direct machine code execute.

That’s is just scratching the surface.

Reply on news.ycombinator.com