<story><title>European govt air-gapped systems breached using custom malware</title><url>https://www.welivesecurity.com/en/eset-research/mind-air-gap-goldenjackal-gooses-government-guardrails/</url></story><parent_chain><item><author>guenthert</author><text>For the old SunRay thin clients one could disable the USB ports by policy (and enable for certain users, iirc).  That was an important feature there, as one intended application was as public kiosk systems, e.g. in a library.&lt;p&gt;The same is possible in Windows 10 and 11, but the users will revolt, if a sysadmin were to enforce such (the same users who insist on using Windows instead of a more secure system).</text></item><item><author>nonrandomstring</author><text>Some organisatios increase this latency by filling the USB ports with hot glue.</text></item><item><author>EvanAnderson</author><text>Given the discipline surrounding most &amp;quot;air gapped&amp;quot; machines I&amp;#x27;ve seen I always find this quote appropriate:&lt;p&gt;&amp;quot;At best, an air gap is a high-latency connection&amp;quot; -Ed Skoudis - DerbyCon 3.0</text></item></parent_chain><comment><author>squigg</author><text>&amp;gt; For the old SunRay thin clients one could disable the USB ports ....
&amp;gt;The same is possible in Windows 10 and 11, but the users will revolt, if a &amp;gt;sysadmin were to enforce such (the same users who insist on using Windows instead &amp;gt;of a more secure system).&lt;p&gt;Can I add a little more colour here (and have worked in and designed-for very secure environments) - users will revolt if removing the USB ports makes their life more difficult. This can work if there is an effective feedback loop that makes sure the users can still do their jobs efficiently in the absence of USB ports, and corrects for them when they can&amp;#x27;t. Users won&amp;#x27;t go around something unless it gets in their way!</text></comment>
<story><title>European govt air-gapped systems breached using custom malware</title><url>https://www.welivesecurity.com/en/eset-research/mind-air-gap-goldenjackal-gooses-government-guardrails/</url></story><parent_chain><item><author>guenthert</author><text>For the old SunRay thin clients one could disable the USB ports by policy (and enable for certain users, iirc).  That was an important feature there, as one intended application was as public kiosk systems, e.g. in a library.&lt;p&gt;The same is possible in Windows 10 and 11, but the users will revolt, if a sysadmin were to enforce such (the same users who insist on using Windows instead of a more secure system).</text></item><item><author>nonrandomstring</author><text>Some organisatios increase this latency by filling the USB ports with hot glue.</text></item><item><author>EvanAnderson</author><text>Given the discipline surrounding most &amp;quot;air gapped&amp;quot; machines I&amp;#x27;ve seen I always find this quote appropriate:&lt;p&gt;&amp;quot;At best, an air gap is a high-latency connection&amp;quot; -Ed Skoudis - DerbyCon 3.0</text></item></parent_chain><comment><author>londons_explore</author><text>Plenty of organisations enforce &amp;quot;no USB devices&amp;quot; on all their users.    Not even super secure places, but just many regular admin-type office workers get their USB ports disabled in software.&lt;p&gt;Partly it&amp;#x27;s to prevent leaking of company secrets, unauthorized use of corporate devices for home use, harder to track the location of data, as well as the possibility of malware.</text></comment>