Nowadays the poor mans 1-way data diode is a fiber link with the bad transmit connector physically obstructed. So you're using fiber where transmit is on one fiber and receive is on the other but the receive is blocked. Then only use 1-way protocols (UDP).
Re:Air Gaps
by JoachimSchipper on Friday October 11, 2013 @01:46PM
(#6534652)
My employer (Fox-IT) sells a data diode (https://www.fox-it.com/en/products/datadiode/). List price is "call us for a quote", but the quote won't be anywhere near $1 MM.
Using a "proper" diode instead of hacking something yourself gets you a guaranteed-good solution - how much do you trust your firmware? - plus some software that automates "I want to send X through this machine" for many common and/or high-value instances of X. That said, custom hardware plus custom software plus certifications plus enterprise sales is indeed (a lot) more expensive than snipping the tx wire/fiber.
Automatically copying USB sticks doesn't seem particularly useful to me.
Re:Air Gaps
by Spearchucker on Friday October 11, 2013 @03:36PM
(#6535409)
The air gap (copying data out of band, as it were) is useful in that the connection can be physically broken by software on the system high side, using a software kill switch, automated schedule or other rules.
Unless you need to transfer large amounts of data quickly, I'd suggest going back to the pleistocene of computing: Use RS232 in a two-wire config. (Data & Ground)
Saves you about 1 million dollars ;)
It seems like a wifi device in monitor mode might work for this. You could write a small utility to assemble streams from sequenced udp broadcast traffic or raw frames, and ensure the radio in the airgap machine never transmits.
Re:Air Gaps
by chockablock on Saturday October 12, 2013 @09:01AM
(#6538575)
> ensure the radio in the airgap machine never transmits
How? Do any wifi devices use separate receive/xmit antennas? If not, then you are back to relying on software.
There are four things you want to do -
1. Get a herd of cash together. The stuff that follows is not cheap.
2. Set up a hardware data diode (an appliance that only allows data to travel in one direction). [1]
3. Set up an air gap like Whale Comm's appliance used to do (two 1U rack-mount servers, back-to-back, which [dramatization alert] automates plugging a USB stick into one server, copying data onto it, pulling it out, sticking it into the other server, and coping the data onto it - at ~10Mb/s, if memory serves). [2]
4. Any time anything traverses the trust boundary, convert from one format to another, so PDF becomes RTF, DOC becomes TXT, PNG becomes GIF, and so on. The point is that converting attachments into other formats drops malicious payloads, or stops them from exploiting vulnerabilities in the apps that open the original formats.
[1] Tenix used to do one, but they cost crazy money (millions). I don't know much about this space anymore, but this might provide some pointers: http://en.wikipedia.org/wiki/Unidirectional_network
[2] Whale Communications was acquired by Microsoft. The product is now called ForeFront Unified Access Gateway, and while still a good application firewall, no longer provides that air gap (http://en.wikipedia.org/wiki/Microsoft_Forefront_Unified_Acc...). I've no idea who else can do this.