Originally Posted by
Courtney Mil
My point was, if your system is completely isolated from the outside world, no physical paths, it doesn't matter who made the chips, they can't create a link where none exists.
Agree. My point however is that there are connections in practise. You are right, an air gap should ensure that there is no interconnection. Regarding foreign chips, it is quite conceivable that a chip could have the capability of bridging such an air gap which is one reason why some computers are supposed to operate in a bubble.
It is relatively easy to view the lateral dimensions of the bubble - you can see if your colleague brings his IPad/IPhone/PAD etc in proximity to your secure PC. It is less easy to not what is happening the other side of a wall, or above or below your office.
The problem with IT security is people. Where there are rules that are overly restrictive then those rules will be circumvented. The rules concerning my MOD laptop were so restrictive I never bothered to use it. At Henlow the passwords were on cards attached to the laptop bags even when the bags were taken off base.
Ed:
While what BS says is true, of intranet machines they are usually locked down to prevent access to unauthorised USB sticks and I guess Bluetooth, but these tend to be human breaks rather than deliberate attacks. My point was that human circumvention of the rules can open up an otherwise secure system to attack.
Some years ago, and I don't know how, but someone got in to the MOD phone system, linked in to Sqn Ldr Ops phone in Akrotiri and then bounced out to Tehran. Apparently it was just a means of getting a free phone call from UK but it showed what was possible.