1

With things like NSA or state sponsored attack, it seems that no one is safe from a technical point of view. Is there any efficient method or strategy to protect against them?

My guess is that relying on technologies is the worst method, as it is very hard (even at large corp) to be better than state sponsored employees.

A method I can think about: I often use a physical layer between network, for example, a computer is connected to the network, but if there is important information, I use a USB to copy data from that computer to another computer that is disconnected from internet, or between them. Work and data on that disconnected computer is quite safe, isn't it?

The data may be exposed in connected computer for a very short time, but may be encrypted before that. Password can be transmitted with a different route, e.g. phone or in physical device. The USB may be compromised but it is a much easier problem. Also desktop computer is quite safe as it doesn't have any wireless connection that may be turned on without alerting user.

From a defensive mindset, what can you do?

2
  • There are many methods to jump an air gap. Stuxnet is the most famous (infamous?) example.
    – Ron Trunk
    Jun 27, 2015 at 13:43
  • Using USB to copy data is a horrifically vulnerable idea. Any medium where you can't first know how much data you expect to transfer, and then validate that only that much was transferred, is a bad idea. Any medium with hidden parts (flash, for example) is a bad idea. You'd be better off printing the data in an OCR capable fixed-width format and either scanning or hand-typing on the other side, validating number of characters, a hash, and ideally actually printing plaintext data or code and compiling it on the other side; don't transfer executables. Jun 28, 2015 at 0:59

2 Answers 2

2

With your disconnected computer, you are describing an Air Gap. A quote at a recent security conference: "An air gap just means higher latency in the network"

You are right that it is very difficult to be perfectly secure. Instead of trying to be perfect, try to improve. Do a self-assessment and calculate what your biggest risks are and then use technical and non-technical solutions to reduce those risks. Then, repeat. An air gap might indeed be one of the technical solutions.

You don't necessarily have to be better, technically, than the state-sponsored attackers. They are limited by the same technological realities that you are. You do, however, have to invest resources (technical, human, financial) in a defense-in-depth strategy that takes into consideration possible bypasses employed by state sponsored attackers. There are smarter people than you and me working on defensive strategies, so your resources should be devoted to following the experts and letting them help you reduce risk.

1

I recently wrote 2 articles exactly about that, however in polish language:

http://fajne.it/zelazne-zasady-dla-uzytkownikow-sieci-tor.html

http://fajne.it/jak-skutecznie-obronic-swoj-komputer.html

Let me repeat the key advices:

  1. Encrypt everything, everywhere. No exceptions. Every disk should ideally be encrypted with different key.

  2. Use separate IT physical computers and routers for "normal" and hidden activities. Virtual machines are not enough.

  3. Do your hidden activities only in safe location.

  4. Install several killswitches in your safe location. Be able to imperceptibly disconnect power from computers.

  5. Do not get caught with mounted encrypted filesystems. Don't do your hidden activities outside safe location. Ross Ulbricht got caught that way.

  6. Never exchange any disks between normal and hidden computers.

  7. Do not work as administrator. And secure your computer.

  8. Use encrypted connections (https), even through TOR. In fact, especially through TOR. Avoid any interaction with http-only sites.

  9. Do not tell anyone about your hidden activities. Even your wife, partner, kids, parents etc. Avoid alcohols and drugs, do not ever use them in unsafe companion.

  10. If you earn money using TOR, do not flaunt your financial condition, and do not buy anything big (car, house etc.).

There are many more rules, these are just the most important ones.

4
  • Some notes about your advices. No 7 should be No. 1. And what is a hidden activity? Of course you have unencrypted files. Finally, everyone knows that TOR sucks. You're the only one NOT knowing it.
    – ott--
    Jun 27, 2015 at 21:38
  • What do you mean by TOR sucks? Hidden activity = activity that user wants to hide from anyone else. Jun 28, 2015 at 7:00
  • en.wikipedia.org/wiki/Tor_%28anonymity_network%29#Weaknesses - and for your hidden activities create one or more identities.
    – ott--
    Jun 28, 2015 at 22:51
  • I know that TOR has weaknesses, that's exactly why I created the above rules. Following all of my rules (including these in linked articles) should give you best possible protection level. Jun 28, 2015 at 22:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .