Most secure way to isolate computer on network

Question

I handle personal client information. Stuff that shouldn't get lost. Because of this, I have had to be careful not to download or install anything that is in any way uncertain. One data stealing virus on my computer could essentially affect all of my clients. I use PDFs, Microsoft Word and Excel for storing the information, and Firefox for communicating with clients via email.

This is a problem, as I've come to a point that I have to test out several pieces of software that do fall into that uncertain category.

To keep my clients' data completely separate from the software I will be testing, I can set up a second computer.

Worst case scenario the testing computer gets hacked.

If they both connect to the same internet line, what can I do to prevent it from doing anything to any other computer on the network?

Answer 1

To isolate off more dangerous/risky activity (e.g. installing software of unknown provenance, as in your example) there are a varying levels of isolation that you can impose between the system

1. Containers. Provides some level of isolation, but the OS kernel is still shared.
2. Virtual machines. Introduces a hypervisor, which separates the environments. There's still some level of risk here if the Hypervisor has security vulnerabilities.
3. Separate machines, same network. Here you can use host firewalls (e.g. the windows firewall, iptables on linux) to protect each machine from the other.
4. Separate machines, different network, same Internet connection. Here you introduce a hardware firewall between the machines.
5. Separate machines, different network, different Internet conneciton. Here you get a separate Internet connection (e.g. run one on a 3/4G mobile connection and the other on a wired connection), to fully isolate one from the other.

So assuming you've decided tha you want to go with option 4, which has a better risk profile, but obviously more cost, than the previous ones, what would that look like.

Well assuming that you're using a cabled ethernet network, probably the best bet would be to get a device that allows for "DMZ" style functionality, and then place one of the machines (likely the one you're using for testing software) into that DMZ network.

Answer 2

The most secure way is to give it its own network. Set up a router so that the testing computer is on its own, and have rules in place to prevent any traffic from travelling from one network to the other.

Answer 3

I agree with Neil Smithline that you should clarify the parts you are having trouble with, but I think i understand enough to give you a few answers.

For separating your computer from the rest of the network, look at setting up a hardware based firewall on your network. I know of Fortigate and Zyxel Firewalls (Note: it takes time to learn how to configure these well). Both can be configured to separate or treat your computer differently when it comes to internal and external traffic. They are very complex though, so it can be a difficult learning curve. Also it can leave holes or other issues if not configured properly, so it can be overkill. Just an idea though, in case you want to try it out.

Anything past that is getting into good IT common sense 101. Such as with AV/Malware scans, encrypting hard drives, configuring software AV/Firewall, and possibly other things that count more as opinion rather than best practice.

So as far as keeping client data separate, all you can do is make sure your work computer is separate from your personal computer, and make sure what you do on your work computer is controlled and monitored. That part will be up to you, because there isn't just 1 answer (hence why Neil suggested to be more specific).