AIR GAPPED LAPTOPS UPDATE
“Many places that use certificate authorities only update their CLR once a year or so, but our requirements meant we had to be doing it every six hours,” Rea explains. After that had been completed, a tech would move the list to the target server using a floppy disk for the update, gradually wearing holes in his $200 basketball shoes. This list needed to be updated by manually transferring the data from one server to the other, regenerating the CRL list, and then having it digitally signed. Managing who had access to certificates meant moving something called a CRL (certificate revocation list) back and forth between the Sun ONE Directory Server and the RSA Certificate Manager CA server. This is exactly the situation that Dartmouth University’s Scott Rea found himself in when he was asked to sync data between an off-network CA (certificate authority) and a highly available, completely on-the-network directory server. There’s nothing but air between these and other networks - hence the term “air gap” - and transferring data between them is done the old-fashioned way: moving disks back and forth by hand, via “sneakernet.” So IT admins must build enclosed systems to house that data - stand-alone servers, for example, or small networks of servers that aren’t connected to anything but one another. In high-security situations, various forms of data often must be kept off production networks, due to possible contamination from nonsecure resources - such as, say, the Internet. And just in case you’re thinking “air gap” refers to a new brand of sneakers … well, you’re almost right.
Federal IT managers face troubling times when it comes to synchronizing an air-gap network.
0 kommentar(er)
