Comment by bane | Hacker News Reader

Comment by bane | Hacker News Reader

Organizations with very valuable networks that are completely disconnected from the internet and have strong policies and procedures about sneakernetting data back and forth.

For example, I might work at a R&D company working on some kind of new magic technology. All of the R&D work happens on the disconnected LAN (call it R-NET) and that's our daily driver. All the computers have software on them to prevent USB drives and other removable media from being plugged in, and no wireless anything, and if I have to move data onto the R-NET from the internet, there's a designated security admin person who does the move. They do it with a physical drive, sneakernetting the data between the networks.

Their process is to get the data, scan with every kind tool known and toss out certain prohibited files (executables, scripts etc.)

If you need an executable or script on the R-NET, you go through another procedure that does a full security audit on that software, and only once it's approved and added to a special list of installable things can it be put on your machine.

Going from the R-NET to the Internet requires a reverse of the process, but everything getting moved out gets reviewed, every document, piece of data, etc. to make sure it doesn't contain anything that shouldn't be sent out.

Everything on R-NET is logged. Everything, log ins, log outs, what software you opened, what libraries that software used, everything.

There might be a security team who monitors the R-NET and the moment they see something suspicious they have a "kill switch" to disable the network and all the machines that are one it until the problem is sorted out.

It sounds extreme, and it is, but it can be reasonably effective. Some places even have different networks for different projects to provide further isolation.

I'm a security guy and I've worked in these kinds of environments and it really sucked.

These days whenever someone proposes creating an air gapped network for a secret project I spend a lot of time enumerating the extreme costs of this configuration. Some of these costs are lowered development productivity, additional hardware and the extra people required for the more intense monitoring.

Air gapped networks are unpleasant to work on but can be a good security mechanism if you truly appreciate the costs.

Yeah, it's a classic risk/cost assessment. You can weigh what a scheme like this costs to implement vs. how valuable your information is and make a decision.

I think it's a good idea for some places to do this, but not all. It really depends.

I once worked on an air-gapped network. I programmed my own Klondike Solitaire, Freecell Solitaire, and Hunt the Wumpus games. The project was named "LBus", which was short for "look busy". I made the user interface look like log entries in a console window.

That's why perimeter defense doesn't work. You always have to let at least one person in, and any person you let in can become an insider threat--especially if their job is to write source code, compile it, and run it. If I need a script or simple program, I wouldn't bother trying to clear someone else's through security if it were easier to just type it in myself.

I feel slightly bad about slacking off at work in that manner, but I still completed all the tasks that were expected of me, and even got actual cash bonuses for exceeding work expectations. That workplace had absolutely no mechanism in place for exercising ambition or creativity, so if that entire department hadn't been destroyed by unethical (and, as I later learned, illegal) contracting practices, I probably would have also eventually devised a way to make Tetris look like the TPS Reports.

It wasn't the worst job ever.

But yes, internal security is a must. At minimum, keep the overly clever people with access to compilers in their own sandbox, away from everyone else. It seems odd to tell someone they can't have a compiled binary when they can just sit at a keyboard and type in "int main (void){ while(1) fork(); }" just for giggles. It's like giving someone a .50-cal rifle and then denying them a 9mm pistol.

It is an actual security issue, but really, as a developer, I just want different security restrictions on me than the non-developer users.

I have a compiler and the ability to execute any code I can imagine. In what network would you not want to wall me off from everyone else?

VPNs can be used on the internal network to separate Dev & Production systems. This works best with strong endpoint isolation. Qubes has a paper on physical vs. software isolation, http://www.invisiblethingslab.com/resources/2014/Software_co...

Reply on news.ycombinator.com