Comment by __d | Hacker News Reader

Comment by __d | Hacker News Reader

I've had some experience with two groups of employers that care: the military and financial trading firms. The basic answer is simple, although it has many side-effects: your work computer is isolated from the Internet.

In both cases, you can end up going to jail for a long time if you leak the code, so there's a fairly strong disincentive. Of course, that's only effective if you believe you'll get caught. And so your computer and the network is fairly heavily monitored, and very restricted in what you can do.

In the military case, there is no Internet access at all. Anything secure is on an entirely separate network. So, no Googling for hints, no Stack Overflow, no GitHub. In the place I worked, phones were not allowed either. If you needed to look something up, you could leave the secure area, use an insecure computer to look something up, and then go back into the secure area. You could bring stuff in (paper), but not take anything out. And remember the "go to jail" penalty if you tried and got caught.

In trading firms, I've worked for firms that pretty carefully control their Internet access. Internet traffic is white-listed, and any site with an ability to upload is either totally blocked, or if it's really, really useful (eg. GitHub), it gets a customized filter in the firewall/proxy that white-lists only the read-only URLs.

Any remote access is done entirely via RDP, locked down to prevent everything except screen + keyboard + mouse.

If the company is issuing laptops that leave the office, or allowing access to GitHub/Lab (and especially using personal GitHub/Lab accounts), then they're not really serious about protecting their code.

I've worked for the DoD in SCIFs. Complete physical isolation, armed security, gates, electronic locks, physical locks, EM isolation (Faraday cages, the works). It would have been trivial to exfiltrate anything I had access to. These barriers are about not letting the wrong people and data in; they are not about stopping data from going out, at least not physically. If anyone working in these facilities wants to physically remove data, it's trivial. Witness Snowden and similar leaks. That's just as easy today as it was then.

That's not to say there are no protections in place. Systems are isolated as much as possible; there are access controls; there are audit trails. As the value of the data increases, the number of logs required to access it increases. Someone's going to know. Something like what Snowden did was trivially-easy to do, but to do that without getting caught would have been near-impossible. The key to Snowden is that he didn't mind getting caught.

In the end, it boils down to trust. Trust is the only thing that prevents data from leaking. You put extra protections in place to prevent data from flowing out via a software bug, backdoor, or simple mistake; you use physical security to limit who can come inside in the first place. But ultimately the only thing that stops data from leaving is being selective about who you let inside. In the case of the DoD, that involves extensive background checks and security clearances. Once they trust you, though, you can grab whatever you want, if you're so inclined.

I've also worked in finance, for market makers, brokerages, hedge funds, giant investment banks. The protections there are laughable. Most places pay lip service to it but don't actually do anything that really protects their data from leaving. Beyond the basics, it's all security theater. At the end of the day, it's again completely about trust.

To answer OP's question: you prevent code and data from leaking by hiring decent people; not doing anything to piss them off so much that they're willing to risk jail; and compensating them well enough that they aren't as easily bought. You should still put technological barriers in place, but they are almost entirely about keeping bad actors out. Throw in some auditing so that people feel like they're being watched. Add in some more security theater to remind people to care.

I've known companies that physically removed all USB ports from laptops.

It's common to have monitoring software installed as well.

In most companies it's not really workable to prevent employees from taking their laptops out of the office.

> I've known companies that physically removed all USB ports from laptops.

Second order effect of Stuxnet .

I think some organizations did that even before Stuxnet.

Supposedly the US military used epoxy on USB ports on machines in Afghanistan. That was after sending someone through the local market with a wad of cash to buy up all the thumb drives there.

> I've known companies that physically removed all USB ports from laptops.

I've encountered desktop setups where various ports were filled with epoxy, rather than being removed.

A co-worker once bridged an air gap using audio. I forget most of the details, but his POC used staccato clicks to evade notice rather than supersonic frequencies (a prior unsuccessful attempt IIRC tried modulating the vsync on CRTs in lieu of speakers, which gave me a headache and prompted me to track it down since I could hear it even though no-one else could).

I've heard of stuff like that, but I'm wondering why your coworker was even trying to bridge an air gap.

Could be a security researcher.

Mostly to prove it was possible to get the PTB to either tighten or relax the air-gap requirement. As in, he found the requirement annoying but in his opinion it failed to meaningfully increase security.

Reply on news.ycombinator.com