Cyberstudy
PDF p.125 In progress

Physical Isolation

Open PDF at p.125 13 flashcards

Summary

PDF p.125

Physical isolation involves disconnecting security-critical hosts from any network to prevent unauthorized access. Air-gapped hosts and networks are examples where no cabled or wireless connections exist to other networks. This method enhances security but presents significant management challenges.

In plain words

Supplementary — not from your PDF

An air-gapped host or network has no cabled or wireless connection to other networks. It's the strongest isolation, used for things like an offline root CA, malware analysis machines, or industrial and military systems. The cost is management: everything is done locally, and updates arrive on removable media, which must be scanned first.

Detailed explanation

PDF p.125
  • Air-Gapped Hosts
    • Definition: Hosts not physically connected to any network.
    • Examples
      • Root Certification Authority: In Public Key Infrastructure (PKI).
      • Malware Analysis Host: Used to analyze malware execution.
  • Air-Gapped Networks
    • Definition: Hosts within the network can communicate, but there is no connection to other networks.
    • Usage: Military bases, government sites, industrial facilities.
  • Management Challenges
    • Local Administration: Device administration must be performed at a local terminal.
    • Updates and Installs: Performed using USB or optical media.
    • Security Risks: Media used for updates/installations must be scanned to prevent introducing malware.

Important terms

taken from the text above
Air-Gapped Hosts
Hosts not physically connected to any network.
Root Certification Authority
In Public Key Infrastructure (PKI).
Malware Analysis Host
Used to analyze malware execution.
Air-Gapped Networks
Hosts within the network can communicate, but there is no connection to other networks.
Local Administration
Device administration must be performed at a local terminal.
Updates and Installs
Performed using USB or optical media.
Security Risks
Media used for updates/installations must be scanned to prevent introducing malware.
PKI Public Key Infrastructure

Examples & real-world scenarios

Supplementary — not from your PDF
  • An offline root certificate authority kept in a safe.
  • A standalone malware analysis workstation.
  • An industrial control network with no Internet link.

Scenario

An air-gapped plant network needs a software update. Staff bring it on a USB drive, so the drive must be scanned on a separate clean station first. Removable media is the main way threats cross an air gap.

Common mistakes

Supplementary — not from your PDF
  • Assuming an air gap means zero risk. Removable media and insiders can still bring threats in.
  • Forgetting the operational cost: no remote administration and slower patching.

Practical skills

Supplementary — not from your PDF
  • Decide when physical isolation is worth its management cost.

What I should remember

Key Points PDF p.125
  • Air-Gapped Hosts
    • Definition: No network connection.
    • Examples: Root Certification Authority, malware analysis host.
  • Air-Gapped Networks
    • Definition: No cabled/wireless connection to other networks.
    • Usage: Military, government, industrial.
  • Management Challenges
    • Local Administration: At local terminal.
    • Updates and Installs: Via USB/optical media.
    • Security Risks: Scan media before use.