News for hackers. Stuff that matters.
Re:CLIP OS – France’s cybersecurity agency’s open source, se... by duxup on Thursday September 20, 2018 @10:22AM (#18032617)
Yeah physical separation... seems like a large and ultimately good step. All the other efforts to logically separate things often have some sort of downside.

I posted a while ago that there was a customer (tied to the military) that forbid ANY outside electronics of any type to enter their facility (main gate where you parked was ok, but you still turned everything over) without approval, and no electronics could ever leave. They went so far as to keep and presumably destroy anything that entered... bring a laptop, it's gone, be stupid and carry a phone, gone (nobody actually did the phone thing as you were warned plenty of times).

Granted they paid a ton for it (for a laptop many times sometimes (other times they gave you one)) and it is mostly a policy only the military can be strict about.

But having said that this was before smartphones and etc, and honestly now a days that seems like what was an extreme policy, is actually a good policy for many such places. We're already at the point where we know we can't be sure about declaring any equipment "clean".

I was a little shocked to hear the White House was talking about banning smart phones in some places.... like how the hell haven't they done that already? A mic and camera on each person that wanders all over the world connecting to random cell towers and wi-fi and OMG, what a great attack vector!

Re:CLIP OS – France’s cybersecurity agency’s open source, se... by kakwa_ on Thursday September 20, 2018 @01:36PM (#18034169)
I've heard a lot of stories regarding security and physical separation.

The most funny was a repair guy from IBM or Cray in the 80ies or 90ies was tasked to repair a broken storage array in a super calculator doing some sensitive computation.

He expected one of the disks to be dead (at the time those were quite expensive) and brought a new one.

He plugged it and it was not that, the array was still KO. In the end it was a broken (and much cheaper) controller card. So he fixed it, and starting to going home. But the guards didn't let him go back with the expensive spare drive and the brand new drive had to be destroyed.

There was some conflicts after that on whether or not the destroyed drive was part of the maintenance contract and who should pay for it (the government agency or the company doing the support and maintenance).

Re:CLIP OS – France’s cybersecurity agency’s open source, se... by duxup on Friday September 21, 2018 @10:24AM (#18039885)
Yeah that's pretty common today even at a lot of places, no hard drives leave the premises.

Generally though there's not much to be confused about in my experience, it is typically in the contract. When I went onsite if they demanded the equipment for security reasons I just handed it over... you'd be surprised how often security guy or IT security guy suddenly doesn't like being responsible for some cards or such and lets you go ;)

Re:CLIP OS – France’s cybersecurity agency’s open source, se... by mavhc on Thursday September 20, 2018 @11:22AM (#18033100)
What happens now people have wireless devices keeping them alive, heart controllers etc?
Re:CLIP OS – France’s cybersecurity agency’s open source, se... by duxup on Thursday September 20, 2018 @12:39PM (#18033754)
I don't recall anything in the policy that spoke to that. That's not a good answer, but it is all that I got. This wasn't a situation where you asked questions / got to.
Re:CLIP OS – France’s cybersecurity agency’s open source, se... by vegardx on Thursday September 20, 2018 @12:00PM (#18033442)
Probably nothing.

The whole point is that electronic devices that can't be accounted for has to be kept back until they can be, or destroyed.