A long time ago ago I worked for a small bank. We used a physically separated network to host our internal servers that handled all the transactions, as well as the workstations accessing the system.
One day someone came along and wanted to build a perl-based web interface for it, and basically tried putting an internet-connected server in our secure server area and plug it directly into the bank server with cat5. This was, of course, promptly denied.
But that made me think; and now, many years later I'm still thinking about it. How can you efficiently "air gap" a network and yet provide services to an outside world?
My idea was as follows.
- Set up an physically separated network with a server hosting critical data (bank accounts, transactions, electrical grid services, voting records, etc). Ensure all normal security procedures for air gapped networks, etc, etc.
- Set up a slightly less sensitive (but still highly secure) internet-connected network for hosting application servers, and beyond that somewhere towards the perimeter, the actual web servers, load balancers, firewalls and so on.
- Run a serial cable between two hosts on the two networks.
- Any communication between the networks, say for inquiring about a balance, posting a transaction, and so on, needs to happen over the serial cable. Any request should also be properly cryptographically signed, so the ultimate authorization lies with the secure servers on the air gapped network - they don't trust anything coming in over the serial wire unless it's cryptographically validated and authorized.
My reasoning here is that once you connect a cat5 cable to a server, there's so many different kinds of traffic potentially occurring on that cable (even with proper firewalls). You can have intruders moving laterally through the network, misconfigured firewalls, there are 65000 possible ports on it and you're using 1 of them - by using a serial cable you're drastically minimizing attack vectors. Of course you still need to secure the software stack behind the serial cable, and there are several other attacks possible here, but I just kind of feel good about limiting the traffic to a custom protocol over a dumb serial cable - kind of like the bridge over Khazad-dûm, if you know.
The downside is that a serial cable is not particularly effective. At 115 kbit/s, it's going to struggle compared to a regular 1 Gbit/s link. I suppose you could use multiple serial cables...
So...
- Is this a good idea?
- Are there better ideas?
- Is there a practical alternative to a serial cable that still doesn't bring a whole network stack with it?