Reply to post: Re: USB is a godsend, but

Between you, me and that dodgy-looking USB: A little bit of paranoia never hurt anyone

Doctor Syntax Silver badge

Re: USB is a godsend, but

"So how do you transfer things too complex for a human to enter into an airgapped device?"

In the context of my reply about epoxy - which I assume is what you're questioning - the immediate reply is learn to read a statement of requirements which in this case was "So, what actions does a user need to take -- a real user, not a Reg reader, mind-- to protect themselves from nasties on the stick when they plug it in?" No mention of Stuxnet there.

The moral you need to take from my reply is that it's a trade-off. If you want to be secure there are things you shouldn't do, sticking random USB devices into a PC is one of them. Self-discipline would be better but if physically preventing yourself or those around you from doing things is the only way of doing that, take the physical route.

As a free-standing question, however, it deserves an answer and the answer, as with so many things in IT is that you have to analyse each situation as you meet it. If you have to make provision for data from random USB devices or the like for a single air-gapped machine a good starting point might be another air-gapped triage machine. You should be prepared to write that one off on that in the event of the sort of nasties you've mentioned elsewhere and, as several of us have said, a Raspberry Pi is cheap enough to make that painless; you can do it out of petty cash. For an air-gapped network LeeD's approach is the way to go. For a stand-alone machine your triage device could have the further level of protection of burning the data onto a write-once optical drive.

In different circumstances there are other options. For instance in the situation I mentioned elsewhere in the thread the main security concern was confidential information in the production side of the business leaking and there they had a factory network separate from the production network. Data incoming to that from customer sources was carefully routed and checked; e.g. incoming XML data was checked against an agreed schema - any file consisting of anything other than a conforming document was dumped.

To reiterate, you analyse the particular requirements and devise a solution that fits. If you need further help my rates are exceedingly immoderate these days.

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Biting the hand that feeds IT © 1998–2019