3

I handle personal client information. Stuff that shouldn't get lost. Because of this, I have had to be careful not to download or install anything that is in any way uncertain. One data stealing virus on my computer could essentially affect all of my clients. I use PDFs, Microsoft Word and Excel for storing the information, and Firefox for communicating with clients via email.

This is a problem, as I've come to a point that I have to test out several pieces of software that do fall into that uncertain category.

To keep my clients' data completely separate from the software I will be testing, I can set up a second computer.

Worst case scenario the testing computer gets hacked.

If they both connect to the same internet line, what can I do to prevent it from doing anything to any other computer on the network?

0

3 Answers 3

4

To isolate off more dangerous/risky activity (e.g. installing software of unknown provenance, as in your example) there are a varying levels of isolation that you can impose between the system

  1. Containers. Provides some level of isolation, but the OS kernel is still shared.
  2. Virtual machines. Introduces a hypervisor, which separates the environments. There's still some level of risk here if the Hypervisor has security vulnerabilities.
  3. Separate machines, same network. Here you can use host firewalls (e.g. the windows firewall, iptables on linux) to protect each machine from the other.
  4. Separate machines, different network, same Internet connection. Here you introduce a hardware firewall between the machines.
  5. Separate machines, different network, different Internet conneciton. Here you get a separate Internet connection (e.g. run one on a 3/4G mobile connection and the other on a wired connection), to fully isolate one from the other.

So assuming you've decided tha you want to go with option 4, which has a better risk profile, but obviously more cost, than the previous ones, what would that look like.

Well assuming that you're using a cabled ethernet network, probably the best bet would be to get a device that allows for "DMZ" style functionality, and then place one of the machines (likely the one you're using for testing software) into that DMZ network.

4
  • Thank you very much. That really does provide a good overview of the options. 4 would be the choice I would go with probably. What problems would I have to account for using that option? (Say for instance a hacker remotes into my computer on the DMZ'd network. Would they be able to locate the other network because it's on the same Internet line?)
    – Smiith
    Nov 2, 2015 at 22:25
  • so they would know your Internet IP address, as it would be the same, but shouldn't (assuming the firewall is setup properly) be able to get to your Internal network where your other PC is. They would have to compromise the router to achieve that, and you should have it configured so that the DMZ network does not have access to administer the firewall (i.e. the port is not open on the DMZ network) Nov 2, 2015 at 22:31
  • I found this reply very helpful and in line with the setup I was thinking. Curious as to why you recommend a DMZ and not a VLAN ?
    – AlexVPerl
    Feb 17, 2019 at 11:39
  • So you can use VLANs to produce a DMZ style facility, but that's a little more risky than different physical ports as there's a risk of either mis-configuration of the VLANs allowing VLAN hopping breakout style attacks, or vulnerabilities in the VLAN control software. That said many companies do use VLAN separation successfully, so it's not an unreasonable choice. Feb 23, 2019 at 10:35
2

The most secure way is to give it its own network. Set up a router so that the testing computer is on its own, and have rules in place to prevent any traffic from travelling from one network to the other.

6
  • What would the network look like when it's set up with its own?
    – Smiith
    Nov 2, 2015 at 21:40
  • Internet connection to router, router splits into 2 networks.
    – schroeder
    Nov 2, 2015 at 21:41
  • Would there be two routers connected to the router? (Or would it be software based?)
    – Smiith
    Nov 2, 2015 at 21:42
  • only one router would be required - but that router connects to whatever you use to connect to the Internet (difference between router and modem)
    – schroeder
    Nov 2, 2015 at 21:45
  • Thank you. That is good to know that it's possible to set it up with just one router. Though I do wonder, when you set up the rules, is it possible for traffic to get around it in any way?
    – Smiith
    Nov 2, 2015 at 22:12
2

I agree with Neil Smithline that you should clarify the parts you are having trouble with, but I think i understand enough to give you a few answers.

For separating your computer from the rest of the network, look at setting up a hardware based firewall on your network. I know of Fortigate and Zyxel Firewalls (Note: it takes time to learn how to configure these well). Both can be configured to separate or treat your computer differently when it comes to internal and external traffic. They are very complex though, so it can be a difficult learning curve. Also it can leave holes or other issues if not configured properly, so it can be overkill. Just an idea though, in case you want to try it out.

Anything past that is getting into good IT common sense 101. Such as with AV/Malware scans, encrypting hard drives, configuring software AV/Firewall, and possibly other things that count more as opinion rather than best practice.

So as far as keeping client data separate, all you can do is make sure your work computer is separate from your personal computer, and make sure what you do on your work computer is controlled and monitored. That part will be up to you, because there isn't just 1 answer (hence why Neil suggested to be more specific).

1
  • Thank you. I am glad to hear recommendations. I haven't heard of Fortigate or Zyxel firewalls yet. Should be a good place to start.
    – Smiith
    Nov 2, 2015 at 22:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .