I play in a game which includes normal risks, but also a wide range of supernatural powers which could affect the security of a network. These may be as prosaic as a retrieving data directly from a device's memory with a touch or as dramatic as sending one's mind directly into a network or constructing a small alternate reality where the laws of physics permit construction of a practical large-scale quantum computer. It is impossible to guess the limits of these abilities, as anything that is permitted in any chapter of the game may potentially come up.
Now, obviously, designing a system that can reliably defend itself against arbitrary unknown attacks that don't have to obey the laws of reality is a ludicrous endeavor. What I'm looking for are ways to make the system unknown-arbitrary-attack-resistant.
As an example, all critically sensitive information is kept on a separate network that is air-gapped from anything that connects outside the building. This would normally be an insurmountable obstacle to anyone attempting to compromise the internal network from the outside. However, I cannot discount the possibility that someone could cross the air gap. Ideally, accessing sensitive information should require an attacker to do at least two things that are practically impossible, just in case one of them turns out not to be.
So, without further ado, the parameters of the system:
- The system has about ten users. They have widely varying levels of computer skills, and these skills may be decades out of date. They will want to run their own software, and they may outrank the sysadmin.
- The users need to be able to access the internet mostly unfettered.
- The users need to be access the internal network, but the access controls may be stringent.
- Some areas of the building are public, but the secure parts are as physically secure as can be. For an attacker to gain physical access to the network can be safely counted as one "impossible thing".
- Off-site backups are a must. Backup sites cannot be guaranteed to be physically secure.
- Both networks may be restricted to known devices.
- The outer network must permit remote logins from certain known mobile devices.
- Files on the inner network will mostly consist of scanned books and papers. There may be many terabytes of such scans. It does not have to be particularly convenient to transfer data to and from the inner network.
- Files may need to remain secure for many decades.
- It may be assumed that there is a skilled individual monitoring the network for anomalies 24/7.
- The budget for the network is around $100k, plus around $10k/year upkeep, unless there's a good reason to go higher. This excludes all labor costs.
Examples of the sort of defense-in-depth approach I'm going for:
- Backup tapes are encrypted with AES-256, and then with a one-time-pad that is sent to the backup site beforehand.
- The building exterior walls are lined with wire to form a Faraday cage.
- The "panic button" physically detaches external network connections, rather than just deactivating them.
- Old hardware is erased, degaussed, and set on fire.
- All of the firewalls are cumulative – if a firewall detects a condition that should have been blocked by another system, it causes a text message to be sent to the sysadmin.
So, then, my question(s): What sorts of measures might be appropriate for a situation like this? What are some good "impossible things" to put in the path of an attacker? How can I design a system to take maximum advantage of defense-in-depth?