0

In the company that I work there are computers that are connected to the Internet and computers that are connected to a Local Area Network. The LAN is considered a "safe zone" and the files that reside there should never be copied/moved to a computer that has Internet Access. So, now, if we want to download an installer for an application for example, we download it in a pc that has Internet Access and then move it using a "secure USB stick" to the Local Area Network.

Is there a way to create an "safe, one-way connection" between a computer with Internet access and a computer from the LAN? This practically means that only files from the computer with the Internet access can be copied/moved to the LAN. In addition to that, if you want to transfer files you would have to provide your security credentials for the network (so, that only users with the appropriate access levels will be able to transfer files).

Is it possible to create something like that and make it completely safe (or at least "equally safe" with the USB method that we currently use) or the fact that the computer with Internet access is connected with a wire to the LAN is a security risk by itself?

NOTE: the LAN setup involves 2 Windows 2003 servers with Active Directory, Web servers and pretty much all the services that you would expect to find in a Windows network.

Improve this question
2
  • do you have a firewall between those two subnets?
    – dawud
    Jun 29, 2013 at 13:34
  • @dawud at the moment there is not even a wire to connect the 2 subnets (for security reasons). That is the essence of the question: can I connect them without sacrificing security or the presence of the wire between them will always pose security risks?
    – Hugh Quenneville
    Jun 29, 2013 at 13:41

2 Answers 2

Reset to default
4

There isn't a way to make it completely safe from network penetration. If a computer that has internet connectivity has a connection to the LAN then the LAN is at risk, no matter how much security you implement. Keep doing it the way you're doing it.

Improve this answer
5
  • +1 I agree. It can be made reasonably safe, but "reasonably" is a relative term and must be defined by the business. There's no way to make it equally safe as the USB stick.
    – squillman
    Jun 29, 2013 at 14:27
  • Completely agree: Sneakernet is the only option here. If the internet facing PC gets compromised the live connection to the internal LAN is at risk too.
    – Tonny
    Jun 29, 2013 at 15:27
  • @Tonny it doesn't necessarily have to be a live connection. The 2 machines can only connect through SSH for example and only for one-way file transfers. I was just wondering if this could be possible
    – Hugh Quenneville
    Jun 29, 2013 at 17:41
  • @HughQuenneville - Anything is possible. You could implement the strongest, most in-depth security measures possible but the fact is if there's a connection then there's a risk.
    – joeqwerty
    Jun 29, 2013 at 18:07
  • @Joeqwerty I am with Joe on this one. Any connection, no matter how well secured is a risk. Take the place I work as an example: Our internal LAN computers only get on the internet through a proxy with stringent filters. Anything else is done on separate PC's on a different LAN which does have a direct internet connection (through another provider). The internal and the internet-LAN are not allowed to be patched in the same room. To easy to accidentally plug in the wrong cable.
    – Tonny
    Jun 29, 2013 at 20:05
2

The Internet is not unidirectional. While you can approximate this type of thing with any number of rules, there has been (thanks to NAT, among other things) years and years spent by many people with strong incentives finding ways to tunnel bidirectional traffic backwards through things as seemingly innocuous (and requisite) as DNS.

If you require that this network be isolated in this way from the Internet, the only way to assure this with any degree of reliability is to ensure there is no physical connection. For this reason, such networks are usually called "airgapped".

Bear also in mind that transferring files across the network does in fact create the possibility of penetration, though it is somewhat rare for opportunistic attacks; before the Internet existed, viruses spread in more or less exactly this way (using diskettes instead of USB drives of course). Additionally, this exact mode of confidential data transiting from the airgapped LAN to Wikileaks is one reason you will often notice that the USB ports on computers in a network with a security clearance are filled with epoxy or hot glue or otherwise destroyed.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .