AIR GAP

SANS NewsBites Vol. 18 Num. 045 has a newsblurb and commentary on "Air Gapping SCADA Systems Will Not Work" published on (June 3, 2016) by the TheRegister.UK with quotes from Supervisory Control and Data Acquisition (SCADA) technology pioneer Faizel Lakhani.

The article focused the criticism for not using air gapped system because many of the current examples of air gapped networks have vulnerabilities that get added over time by employees who introduce technologies that wouldn't be allowed if the system was managed properly. 

Building a successful and effective air gapped system requires a dedicated culture of security engineering that is hard work.  Not doing that work will more than likely introduce threat vectors that a dedicated adversary will exploit. 

 And in other air gap news recently:

• Software-Defined Perimeter (SDP) outlined at Network World
• The government of Singapore is considering disconnecting some systems from the Internet [straitstimes, channelnewsasia, thestack, themiddleground.sg]
• Deploying an air gap is a solution to consider for some vulnerability problems according to Info Security Magazine.
• Press Release On: CyberArk delivers malware protection for industrial control systems.

Per FreeBeacon.com and TheHill.com there is news that the FBI has warned power companies about additional cyber threats to the United States critical infrastructure (i.e. the grid).  

This warning drives home the continued need to not only protect your air gapped network from digital threats, but also to make sure you completely understand and protect your power needs required by your air gapped network:

• Your Grid
• Your Generator
• Your Backup Battery

You more than likely aren't able to completely power gap your air gapped system from the grid, but you do need to consider how to isolate as much as possible your generator(s) and your backup battery(s).  These capabilities will more than likely have industrial control systems (i.e. Internet of Things) that need to be protected from external threats.

If you have any best practices then please let us know by leaving a comment.

There is reportedly a new particularly advanced USB-savvy malware being called "USB Thief" (Google Search) being discussed by many in the technology press.  

If you allow users (including system admins) to use USB storage devices on air gapped systems then this threat can be a potential attack vector a persistent attacker could deploy against your organization.

Basically an infected USB device could be inserted into an air gapped computer where it could collect considerable amount of "protected data" and then exfiltrate the "protected data" back to the infected USB device. Once the device is removed there is reportedly no trace of the malware on the compromised system and no record of the data collected.

Best defense would be not to allow USB storage media on air gapped systems.  Otherwise, restricting data migration from the air gapped network (i.e. the high-side) to the internet network (i.e. the low-side) would be another defensive measure.  Good physical security would also limit the effectiveness of this threat vector.

Some links with more coverage (some of it F.U.D.): techtimes.com, sci24h.com, arstechnica.com, pcworld.com, thestack.com, securitybrief.co.nz, slashdot.org, idgconnect.com, and itsecuritynews.info, 

There is a new open source effort to build out a working data exfiltration toolkit using radio frequencies.   The source code has been posted to GitHub.  More info on the news at Softpedia. 

The key defensive measure would be to make sure no malicious rogue capabilities make it to your air gapped networked systems, and that you consider RF shielding countermeasures.

Researchers preparing for a future conference presentation have released details (PDF paper here) of their successful electromagnetic (EM) attack against an air gapped system that included no additional software to be previously installed on the system being hacked.  The hardware costs to build the attacking system was around $3000.  The air gapped system had no TEMPEST protections (PDF reference for more information).

You can read more via:

• DailyMail
• TechWorm
• TimesOfIsrael
• Motherboard@Vice
• Softpedia
• OO7Software
• ComputerMagazine

This PDF guide entitled What You Need To Know About NIST Guidelines for Secure Shell (SSH) from shh.com is excellent.

If you are already investing in an air gapped network and using SSH, then you should pay close attention to the recommendations in this guide.

The basis for this guide is the NISTIR 7966 (PDF).

The Register published news of a recent presentation by (@ynvb & @oppenheim1) that IP-enabled KVMs can be attacked in such a way to enable access on a closed network (no Internet connectivity).

The United States Department of Defense's definition of an insider threat:

An insider threat is defined as someone who uses his or her authorized access to damage the national security of the United States, whether through espionage, terrorism, unauthorized disclosures of classified information, or other harmful actions.

Per Gizmodo, there is a proof-of-concept of how a smartwatch could be used to leak keypad numbers on an access control door or other PIN protected resource.