Doesn't "air gapped" imply physical separation? Putting a firewall, even if it's totally locked down, between two networks does not make it "air gapped".
You can get physical separation with WAPs, too...
Air gaps never exist (2011)
11–20 of 53 posts
Re: Air gaps never exist (2011)
#12> "How do you think I got the firmware updates? We just made an SSH tunnel over TCP 53 and proxied HTTP to the Sun website."
Sounds like the real problem was they didn't have a better mechanism for getting things like that in. If a security system stops people from doing their jobs, they'll poke a hole in it unless you provide a better option.
Re: Air gaps never exist (2011)
#13Pedantically, not a "gap" if there's a network cable going to another network...
Years ago I was told by a colleague that he was required to setup an administrative system that was NOT connected the network, but also had to be able to send and receive e-mail.
The inherent contradiction was lost on the people giving the orders. So...
Re: Air gaps never exist (2011)
#14> the blue cables in gas filled tubes Cat5/6 cables? Why would they be in gas-filled tubes?
https://webcache.googleusercontent.com/search?q=cache:wZ0Cex... http://www.gocsc.com/userfiles/file/ortronics/whitepapergovt... https://security.stackexchange.com/questions/10447/is-the-us... I'm honestly not familiar with these kinds of facilities, but with a potential "Collateral Confidential" type cable, one could imagine a gas-filled tube being a countermeasure of some sort.
For instance if the gas were poisonous?
Re: Air gaps never exist (2011)
#15I thought "air gap" meant a machine or network that is physically separated (these days also without any radio connection) to other machines.
How can those not exist?
Re: Air gaps never exist (2011)
#16Pedantically, not a "gap" if there's a network cable going to another network...
Years ago I was told by a colleague that he was required to setup an administrative system that was NOT connected the network, but also had to be able to send and receive e-mail. The inherent contradiction was lost on the people giving the orders. So...
Well he was an expert.. wasn't he?
https://www.youtube.com/watch?v=BKorP55Aqvg
(Draw seven perpendicular red lines)
Re: Air gaps never exist (2011)
#17Earlier quoted context omitted.
https://webcache.googleusercontent.com/search?q=cache:wZ0Cex... http://www.gocsc.com/userfiles/file/ortronics/whitepapergovt... https://security.stackexchange.com/questions/10447/is-the-us... I'm honestly not familiar with these kinds of facilities, but with a potential "Collateral Confidential" type cable, one could imagine a gas-filled tube being a countermeasure of some sort.
For instance if the gas were poisonous?
More likely there is a pressure sensor, intended to detect splicing attempts.
Re: Air gaps never exist (2011)
#18I thought "air gap" meant a machine or network that is physically separated (these days also without any radio connection) to other machines. How can those not exist?
Perhaps you should read the submission. The larger point here is that even if you set up a network in the first place which is genuinely airgapped, as time passes and systems evolve there will be constant pressure from within and without to re-establish a network connection somewhere in order to make everyone's lives easier and eventually, whether deliberate or inadvertent, a connection will be made (and of course, we know that the NSA has a variety of infiltration and exfiltration methods to get across air gaps, such as dropping flash drives and waiting for an insider to be foolish enough to bring it inside).
Believing that an air gap exists or will continue to exist indefinitely is hence setting yourself up for some unpleasant surprises in the future, and encourages weak security designs where the network/system is crunchy on the outside and all delicious and soft and gooey on the inside. (Which is more secure, to have your local WiFi set up with WPA or whatever and have employees telnet into servers, or just go Google-style and have fully encrypted end to end links without requiring any belief in security of the links?)
Re: Air gaps never exist (2011)
#19> I have seem so many kludges connecting SIPPER and NIPPER networks
I don't know how much I trust someone who can't even get the acronym for SIPR and NIPR right (https://en.wikipedia.org/wiki/SIPRNet https://en.wikipedia.org/wiki/NIPRNet)
Re: Air gaps never exist (2011)
#20> "How do you think I got the firmware updates? We just made an SSH tunnel over TCP 53 and proxied HTTP to the Sun website." Sounds like the real problem was they didn't have a better mechanism for getting things like that in. If a security system stops people from doing their jobs, they'll poke a hole in it unless you provide a better option.
> Sounds like the real problem was they didn't have a better mechanism for getting things like that in.
Any mechanism for getting things like that in is a break in the air gap, by definition. (Well, by a strict definition.) But at least a better mechanism would be managed by security policy, not by underlings' need to get their job done. (That is, the security policy would have to take into account the need for updates as well as the potential security implications of importing new executable code from outside.)