What we did was use a serial port, but with no protocol (just plain ascii) and with the return wire physically cut. There was hardware flow control (RTS and CTS were there), but you could only send data one way. The logging machine at the other end wasn't connected to any other network.
You want security, you have to deal with physical security.
As a point of order: serial port exploits exist for other OSes (Linux, Juniper, Cisco, APC...) and also for windows virtual com ports so whilst probably not trivial it's not entirely infeasible either.
The other problem with it is anthropomorphic Stuxnet, which giggles like a schoolgirl when anyone says there's no route to the Internet.
Could you explain what does that `anthropomorphic Stuxnet' stand for?
True, but I don't think that's central to what most governments are seeking to do, if it is as all. Even the US "kill switch bill" was almost entirely about things other than the so-called "kill switch".
Could you explain what does that `anthropomorphic Stuxnet' stand for?
The "anthropomorphic" bit was just me being excessively silly and forgetting that it's not a very common word even among native English speakers. My apologies. Stuxnet does not, in fact, giggle.
As for Stuxnet: As jrockway correctly pointed out you can secure a network against attacks from the Internet by not connecting it to the Internet. But, on the other hand, one of the most notable attacks in recent history, and one that I think that governments have in mind when thinking about cybersecurity, is an attack that targeted (and reached) systems which weren't connected to the Internet.
http://en.wikipedia.org/wiki/Anthropomorphism Anthropomorphism is a term coined in the mid 1700s to refer to any attribution of human characteristics (or characteristics assumed to belong only to humans) to non-human animals or non-living things, phenomena, material states and objects or abstract concepts, such as god(s).
http://en.wikipedia.org/wiki/Stuxnet Stuxnet attacked Windows systems using an unprecedented four zero-day attacks (plus the CPLINK vulnerability and a vulnerability used by the Conficker worm) It is initially spread using infected removable drives such as USB flash drives, and then uses other exploits and techniques such as peer-to-peer RPC to infect and update other computers inside private networks that are not directly connected to the Internet.
Semi-related, there was that old sci-fi story by Stanisław Lem. A mad scientist was researching two AIs (based on organical matter, IIRC) that somehow communicated with one another in spite of some distance and thorogh screening of all known means of communication. The scientist was puzzled beyond comprehension; story's protagonist notes the scientist himself served as as unnwitting messenger -- as he (affectionaly) touched AI's chassiss, he subconsciously passed data by taping on 'em, probably somehow `programmed' to do so by the other AI. Oh well.
At work, we have an IP network called BARONET. It's like the Internet except it's not. There is a bridge on one machine that proxies HTTP requests from this network to the Internet. There are no routes to the Internet.
This significantly reduces the possibility of "cyberattacks", since you'll have to go through that proxy box. (Which probably runs Windows, but hey... if you actually cared about security, you wouldn't do that. The rest of the idea is good.)