I've not played in this space for a looong time but...

There are four things you want to do -

1. Get a herd of cash together. The stuff that follows is not cheap.

2. Set up a hardware data diode (an appliance that only allows data to travel in one direction). [1]

3. Set up an air gap like Whale Comm's appliance used to do (two 1U rack-mount servers, back-to-back, which [dramatization alert] automates plugging a USB stick into one server, copying data onto it, pulling it out, sticking it into the other server, and coping the data onto it - at ~10Mb/s, if memory serves). [2]

4. Any time anything traverses the trust boundary, convert from one format to another, so PDF becomes RTF, DOC becomes TXT, PNG becomes GIF, and so on. The point is that converting attachments into other formats drops malicious payloads, or stops them from exploiting vulnerabilities in the apps that open the original formats.

[1] Tenix used to do one, but they cost crazy money (millions). I don't know much about this space anymore, but this might provide some pointers: http://en.wikipedia.org/wiki/Unidirectional_network

[2] Whale Communications was acquired by Microsoft. The product is now called ForeFront Unified Access Gateway, and while still a good application firewall, no longer provides that air gap (http://en.wikipedia.org/wiki/Microsoft_Forefront_Unified_Acc...). I've no idea who else can do this.

Nowadays the poor mans 1-way data diode is a fiber link with the bad transmit connector physically obstructed. So you're using fiber where transmit is on one fiber and receive is on the other but the receive is blocked. Then only use 1-way protocols (UDP).

My employer (Fox-IT) sells a data diode (https://www.fox-it.com/en/products/datadiode/). List price is "call us for a quote", but the quote won't be anywhere near $1 MM.

Using a "proper" diode instead of hacking something yourself gets you a guaranteed-good solution - how much do you trust your firmware? - plus some software that automates "I want to send X through this machine" for many common and/or high-value instances of X. That said, custom hardware plus custom software plus certifications plus enterprise sales is indeed (a lot) more expensive than snipping the tx wire/fiber.

Automatically copying USB sticks doesn't seem particularly useful to me.

The air gap (copying data out of band, as it were) is useful in that the connection can be physically broken by software on the system high side, using a software kill switch, automated schedule or other rules.

Unless you need to transfer large amounts of data quickly, I'd suggest going back to the pleistocene of computing: Use RS232 in a two-wire config. (Data & Ground)

Saves you about 1 million dollars ;)

It seems like a wifi device in monitor mode might work for this. You could write a small utility to assemble streams from sequenced udp broadcast traffic or raw frames, and ensure the radio in the airgap machine never transmits.

> ensure the radio in the airgap machine never transmits How? Do any wifi devices use separate receive/xmit antennas? If not, then you are back to relying on software.

A few years ago, I once met someone who worked on imaging devices for satellites for a military contractor, which was about all he would say about the specific work he did. He indicated that the building they did their work in had _no_ internet access. Generally, if they wanted to refer to things on the internet, they had to go to some internet-connected computers in another building, print out whatever they wanted and bring it back to the building they worked in.

Perhaps it's unrealistic to expect security without tradeoffs of convenience.

Sounds like standard operating procedure for Classified programs. Everything is either printed and brought in, or burned to a CD-R and virus scanned and then brought in.

What you want is a firewall that uses deep packet inspection so that only data meeting your specifications get's through aka it's an XML file with the correct schema. Unfortunately, you can't exactly trust of the shelf Software for this stuff, however a firewall can be far simpler than a modern OS so they tend to be much more secure so you are reasonably safe just updating the inspection code. Though if you have a sufficient budget or are overly paranoid you can build your firewall from scratch. Also, what you do at the endpoint matters, opening websites in IE is going to be far less secure than say doing day trading using custom software.

That said, the usual rules of defense in depth still apply, ensure that your machine can only talk to a white-list of IP address, etc etc.

I'm a big fan of Qubes-OS. It's an interesting OS distro that's based on the Xen hyprevisor and allows you to maintain different VM zones that integrate with the desktop.

You could have a Banking VM that only runs a certain browser and the firewall only lets traffic to-and-from your banks site. You Work VM could be set to only allow traffic through a VPN connection to your work. Your BitCoin VM could be set to not have any network traffic at all. You could even have a Tor VM with a browser.

http://qubes-os.org/trac

But qubes did issue a security advisory , talking about a security bug in VT-d/VT-x hardware that only intel can fix. For someone like schneier who want to avoid the NSA , maybe qubes is not enough.

What about having two computers, one connected to the internet, one disconnected. Then develop and install two custom services - one obtains the required information, e.g. the trading data, from the internet or sends data to the internet. The other service runs on the disconnected computer and communicates with the software actually using and producing the data, probably in the form of a proxy server.

Finally connect both computers using something simple like a null modem cable and make both service communicate over this link using a very simple proprietary protocol. Assuming the disconnected computer is not already compromised before you start using the system and you have not been extremely sloppy when you designed and implemented the two services, it should be quite hard to compromise the disconnected computer.

One way would be to find valid data (passing the protocol checker in the receiving service) to be transferred from the connected to the disconnected computer that triggers a bug in any data consuming software leading to code injection and execution which in turn sends secret data over the null modem link to the (compromised) connected computer. That seems to be a quite a complex attack to me, especially if the data traveling over the link is something simple like stock price time series which enables very simple protocols and thorough validation.

To avoid some classes of bugs, e.g. buffer overflows, in the services linking both computers I would implement them using a managed runtime like .NET. This will of course expose the system to vulnerabilities in the underlying runtime.

Depending on the bandwidth you wanted, the first thing I thought of was having the output orders on one computer - perhaps using something with a higher data density than plain text - aiming a webcam at that computer's monitor and using some form of image recognition to copy the orders across.