53. Virtual Networks are Air Gapped – Tech Field Day Podcast

In the world of high stakes data protection, security is paramount, and there's no more secure system than one that's air gapped. But what does air gapped mean? And are we changing the definition of the way the word is used?

In this episode of the Tech Field Day podcast, virtual networks are air gapped apt. Welcome to the Tech Field Day podcast, where each episode we bring together a group of experts from across the enterprise IT space to discuss a single topic or a premise related to enterprise it. The Tech Field Day podcast is often recorded in association with one of our tech field day events.

This week we're at Networking Field Day. Tech Field Day is a part of the future room group, and we are excited to be bringing you some of the brightest folks in the IT industry. I'd like to take a moment for our panelists to introduce themselves before we jump into today's episode.

Hi, I'm Carol Warner ese. I've been in networking for 30 some years and happy to be here. Um, I'm Jason Ginner, been in in networking for, uh, 20 some years, and, uh, also very happy to be here.

John Osmond from, uh, consultant from Albuquerque, New Mexico. Um, most of the work I'm doing right now is working with the state of o uh, the state office of broadband. And I've been, been doing this type of stuff for whole, um, n have 30 years or so.

My name is Tom Hollingsworth and I'm a practice lead for Tech Field Day here at the Futurum Group. Let's jump into the premise for today's episode. It's an iconic movie scene, an aging movie star dangling from a rig attached to the ceiling, trying to hack into an unhackable computer with lights and sensors everywhere.

The black vault at Langley is the most air gapped system we have ever seen on a movie or TV set, but today I'll just put it in a different vlan and nobody'll be able to get to it. Right. This episode we are gonna unpack whether or not air gap networks, I'm sorry, we are going to unpack whether or not virtual networks are air gap networks.

And the reason why we brought that up is because during this event here at uh, networking Field Day, we had a number of companies who told us that their solution was Air gaped, which, um, created some Problematic questions from the delegates because they're like, well, what do you mean? Like it's completely isolated, right? Like, I have to walk over with a floppy disc in order to upload information and there's an armed guard with poison chi darts that will shoot me if I don't have the right, uh, passphrase of the day and then I don't match my photo.

And everyone's like, uh, no, we're, we're, we're just, uh, sending the traffic down at a different wire. Like that's air gapped, right? So I'm gonna, I'm gonna open this up to my, my panelists here because I'm sure that they have a strong opinion about this.

Why can't a network be air gapped as long as the traffic channels are just separated? Uh, I think the, the term itself, air gapped implies there's air in between. You know, it's that it's a, that physically separate environment, not just virtually separate.

You, you've been buying those vacuum sealed cat five cables 'cause there's air in those things. Very true. Uh, i, I just, I just feel as though the, the, the term implies the, a degree of security where there's, there's a physical isolation from, from, uh, uh, the other things that, that, that, uh, you know, uh, uh, that, that could, uh, result in, uh, exposure from breach.

So I think a virtual environment doesn't really, and I don't think it meets that criteria. Well, I'm not sure. Um, there are some instances where you can use virtual networks and have air gap.

So if the routing process doesn't know how to get to a sub done, if you can't get to the network from, um, say the enterprise has a storage network that they don't want anyone to reach. And if you can't get there from anywhere in the, in the network, then it is air gapped, even if it's on the same infrastructure. I, I just think go back to the days of enter cap and things like that.

You can confuse this equipment to actually let it drop things from each of these virtual contracts into another one. So I don't think we can actually say that an air gap is an air gap unless it's physically has air it. I mean, my good friend John Pross, who was my Novell, uh, maj, was able to hide an entire Novell server on a network by e uh, changing ethernet frame types.

Four workstations on the network could talk to that server. Yes, it was plugged into the network, but we considered that air gapped because literally no one could talk to it if you weren't on one of those workstations. And it was because a principal was absolutely paranoid that one of the students was going to hack into the database to change their grades.

'cause I guess he watched Terrace Bueller's day off. So would, would you consider something like that where we do protocol trickery to hide things as being sufficiently air capped? Or do we actually need to unplug the machine and run it across the room to isolate it?

I think there's so many other terms for, for virtualization of network. Um, there, you know, we've got VRSI mean, you mentioned VLANs. I think that there's already terms for that, that level of separation.

Uh, and, and again, I feel like air gap implies a physical separation, uh, a a secure, uh, environment that physically secure environment for, for Then why do we keep using the term? Because I feel like isolated or secured or those words are way better to describe what we're offering. Why are we so hung up on air gap?

So, So when I was talking about the air gap storage network, it's truly a isolated storage gap. I use the term wrong and I think it's because a lot of terms sometimes are, um, sexier current or we won't say marketing, right? Right.

And so when, when a vendor gets up and says, we are air gaped and then shows connections to the clouds and connections into the internet and collections from here and there and here and back to them, it's like, yeah, no, that's not area gap. And so there's a kind of a definition, and like in a car, there's a firewall, there's a space between the engine and the compartment where people sit and that's near gap. And we expect the sort of same thing in a network.

And so a, a real air gap is a separation. You can't get between the two sort of A DMZ, All of the, all of these separations, you know, we're networking. We've been doing these things for years and years.

It's all tunneling of some type. I don't care if it's a different frame. Encapsulation on Anl network.

It, I mean network network. Two secure shell sessions from one person's laptop to the same router. Do you call that air gap connections?

Because I mean, I've got two connections that don't, they don't run on top of each other. Um, I think that, you know, when you wanna look at it that way, I, I'll change my mind. That's air gap.

I mean, you, you've got the ability to keep things away from each other. We've got separate channels. There's no way for things to bleed through them.

So a lot of it too is, uh, level of risk you're willing to accept. So what's my definitive definition of air gap? Depends on who my customer is or who's trying to get an air gap.

So what do you need an air gap when you say you want an air gap? And they might come and say, I wanted an Eric Gap, says, do you want this? Do you want, no way ever anyone could get between things, even me when I've built your network.

So if you wanted say that the person who designed your network can't get to some other piece on your network without walking to another room, that's a true error gap. But if you wanna say, well, you're an exception, um, it's okay if this under these circumstances of that can happen. So you have to really sort of de define what do you want, what level of air gap do you mean?

Is it close? Is it like a centimeter, a millimeter, the Yard? What about the folks that are, you know, the, the, the always theoretical, and I don't think it's theoretical anymore, the attack where you actually use air as the medium and you actually use sound to transmit things at that point.

Even an air app isn't sufficient for these types of things. It's how do you build these channels and what, uh, you know, what modalities are there for them to actually move information from one place to another. And how, you know, is it tunneled there, is it tunneled here?

Um, where where is the wrapping mechanism to get the data from one point to another? And what is it, what physical, medium, what protocol, medium things of those nature. Well, I guess the question then comes up if, if we're building these ridiculously ultra secure networks, who, who needs them?

But like, that's the thing. If you give me enough money and enough resources, I can make a network so secure, nobody will ever be able to get into it. You Might as well turn it off.

And that's usually what we end up saying is, is the only way this computer can be more secure is if you only power it on to do certain things with it. But then that comes back to, well, how useful is that system? And what kind of data are you storing on there that can never be observed by another human being who isn't like hooked into the borg hive mind?

I mean, we, we know that the ultimate answer is gonna be someone in the Department of Defense who has secrets that are so secret that if I even knew they existed, let alone what they were, my brain would explode into a thousand pieces. Right? I don't know that outside of maybe three things, there's any data that, that is that secure.

Well, It maybe not, it's not secure, but it's valuable. And so if I came up with a next AI algorithm that's going to someone's example this week, create a ton of fertilizer for a penny, and then just sort of change the world, change the market thinks that information is totally very important to someone, right? And so that information I might wanna protect 'cause I have a vested interest in it, I built it, I can monetize it, I can make a lot of money, or I wanna change the world and feed people, hungry people everywhere.

And there will be actors that don't want that getting out. So it's sort of how valuable is the information? It's not necessarily just security information that has to be separated and isolated.

It's, um, just intrinsically valuable information maybe. Okay. It comes down to, it comes to value, whether it's, whether it's intelligence or if it has monetary value.

And then the piece that I start thinking about on this is what are the mechanisms you use to keep these things apart? Is it, you know, is encryption ability to, is there a way to do air gapping? Can you actually say this thing is encrypted from this point to that point?

So if effectively got an air gap that no one can get into this for a given amount of time. So what about quantum encryption, which we were talking about earlier this week. Can we use quantum encryption where someone tries to listen and it changes the data so they know it's it's an alarm and it's there.

I mean, like, do we need that? Well, But you, I think you guys are kind of, you're, you're, you're moving past an obvious problem here. Um, John, you bring up a good point.

Yes. This, this system needs to be air gaps so nobody ever can touch it. Uh, you enabled file vault, right?

You've enabled login, uh, challenges, you've disabled all of the USB ports. Uh, my good friend Edward Hilly just pours super glue into the USB ports on his systems so that nobody can ever access them. Uh, you've made it so that the, uh, their sound deadening equipment, so nobody can analyze your keystrokes to figure out your password.

The monitors all have those, um, polarizing grills so that you can only see them when you're dead on, right? I just named off a whole bunch of things that will infinitely raise the security of your network without having to isolate that machine. But what's the first thing that everybody wants to go to?

Oh, this has to be air gapped. Think about the number of laptops that are currently running a program that if they're out of contact from a main control server for more than a week, they automatically wipe. To me, that's just as secure as having an air gap system because if I'm not checking in regularly, data's gone.

And, but yet we get back to Tom Cruise dangling from the ceiling trying to hack the knock list out of a hacker bell 4 86. You just said hack. How did that, how does that, how has the word hacker changed throughout the years from somebody that was clever in doing something neat to something that's kind of nefarious?

So is air gap gonna change so that it's from, it's not talking about a physical air gap between things or is it some construct that we build that stops the Immediate passing of data? And the irony is, is that the original hacker Captain Crunch, whistled DTMF tone in through the air into a phone receiver to hack long distance. So not even a phone receiver is safe from hacking, but you're right.

What we have gone from is people who are investigating technology to understand how it works and make it work better to, um, individuals who wanna be famous and deface things to now like highly commercialized nation state backed criminal gangs that are looking, they're rifling through executive emails trying to uncover new product releases. They're, they're getting into like, you know, uh, business Newswire, pr Newswire databases the day before something happens so they can make money off the stock so that they can turn it into Bitcoin so that they can then back a nation state government that's isolated from the world by sanctions and things like that. That's a long way from a whistle and a box of cereal.

So in a world where we think that as long as we unplug the machine from the network, we're safe, is it even possible that that's not enough anymore? You still have to worry about EMF and can you, I mean, you might have to be in a magnet, uh, enclosed space, A a skiff, a secure compartmentalized information, uh, center where basically it's, it's shock isolated and surrounded on all sides by deadening equipment and like, you can't bring your phone in there. Although we've seen pictures of, uh, uh, members of Congress who just love to bring their phones into skiffs and, and the intelligence people who roll their eyes because you're not supposed to do that.

And that was actually one of the things that I was thinking about was, uh, when you look at a lot of the way that information has been disseminated from supposedly secret systems as of late, you're right, this paper is colored fuchsia and has stripes all over it that says do not copy. And then I reach into my pocket and I grab the greatest, you know, uh, little minox camera that ever existed and like, and then I can upload it to my iCloud account. So we've already found ways to get past that.

I mean, look at someone like, uh, Edward Snowden or, uh, Chelsea Manning who basically plugged their iPod into their computer at work and was able to download files because it turns out iPods can store PDFs just as well as they store in p threes. And they were able to sneak a lot of information out there. And that system for all we know could have been air gapped.

So are we, are we overblowing this, are we, are we holding companies to a standard that is unrealistic by saying, you can't call it air gapped unless there's air in the middle when what we're really saying is you should change the terminology to refer to it as an isolated system or change it to a compartmentalized system. Yeah, I think it's become an overused and maybe nebulous term, Kinda like military grade encryption, right? Yeah.

Like That military intelligence Or cloud, you know, just nebulous could mean know a bunch of different things to different people. And uh, you know, I feel like in the modern context of marketing teams have probably, you know, latched onto it to imply a certain degree of security. Um, but it doesn't really, I don't really think it fits the, the original context.

It was, it was, you know, meant to, meant to have, Yeah. So maybe it's sort of, um, we need to hold the vendors or the people who say, my system is Eric Apt, a little more accountable and say, I accept when you say my system is isolated, my system can be secured, my system is this. But when you say air gap and I look up the dictionary, what does air gap mean?

I expect isolation and so, and physical isolation and no possible, and you can't just say, well, it's air gap because the only people who can get to it or, uh, on your own site. I, I would agree with you. Will you look up the word literally in the dictionary and tell me what it means?

Um, no. 'cause if I get up again, I'll break my mind. Well, the thing is, is literally now liter, it literally means its own antonym because we have redefined what the word literally means.

It means something that actually happened, but also something that figuratively happened. I mean, let's be fair, the name of this podcast used to be something that in the entire tech industry said, oh, when I'm talking about something happening in a physical location, it's on premise. No, it's not, it's on premises.

However, we have redefined terminology over the years, right? So why can't we just roll with that? What's the harm in letting them say that it's air ga when we all really know that it's not really air gap, but we really can't change what they're wanting to say.

Um, may maybe, uh, folks who just be wary of the term and, and really get more information about what that means to the, when they hear air ga find out what precisely does that mean? Because again, I think that the term's a little too ne ne nebulous to assume, uh, anything. Or when you hear the term Avenger says, my technology is air gat, you just look at 'em in the face and say, you know how you tell when a vendor is lying?

They move your lips. And when you say the word air gap in your lips, you're live. But at the same time, we're practitioners, right?

Our job is to make all of the sales lies come true. No kidding. That's actually what one of my sales guys told me in my old career.

How can we increase the security level of these, uh, systems that they say are air gap to make them more air gapped? Like what, how can we as networking and security professionals, I mean, I I remember stories of snort sensors that had their transmit wires clipped so that they couldn't accidentally reveal their location to people that were trying to evade the IDS. I mean, it's a little extreme.

I I don't need to carry wire cutters, but like, what, what can we do to help make this a better place so that maybe it's not air gapped, but it's ultra secure That's gonna come down to, do you wanna do it in a physical layer? You just talked about clipping wires. I mean, conceivably you could, if you knew where people were going, you could add a packet level, route everything to a dead end and a black hole someplace so that only the traffic you want going is some going to the right place.

You do the same thing at any level in the stack. And, um, when, as I keep telling, every, every single one we're doing is a tunnel of some type, it's an ASE tunnel from, you know, your keyboard into that router. If you're spear shelled in, at some point in that tunneling point, you can circumvent the traffic.

You don't want to be moving to black hole or die or go someplace where it's, where it's being assimilated and watched in any of those pieces so that you can keep track of it. And air gaps. Do you want, is an air gap gonna be something you want to look at the data?

Or do you just want to throw it away so it can't be used at all? Because there's a lot of information that, you know, the stuff you would normally throw away knowing it exists as a very good, you know, might be pertinent to you as well. So maybe air gapping isn't the right thing you wanna do.

Maybe it's, I want to corral the data I don't want so that I have it as as an intelligence source. And it might be just a discussion point. So if my customer comes to me and says, I got this technology because it can be air gap, make it so, and I'll, I'll talk to them and say, okay, what do you mean by air gap?

How isolated do you want it? How much effort do you want to separate your information? How hard do you want it to be to upgrade your devices from new patches come in, how hard you want it to be for anyone in the universe to reach it, anyone in your organization to reach it, anyone in a department to reach it?

And it, it sort of, uh, will, uh, open discussions. So let's have some more discussions about what you want to say. So if the vendor might have told you it's air gap, eh, yeah, it's possible I can make it air gap, but you'll never use it.

I can make it this, I can make it that how I make it so it works for whoever bought it. So it become a more general term that implies a high degree of security, but you shouldn't really dig into A potential for a high degree of search. Yeah.

Although it could be air gap. It doesn't have to be, and it might never be air gap. And then when they say, oh, well I bought it 'cause it was cool, but I don't really want that.

Well, all right, let's figure out this mess stuff you got how we can build what you need. Tom pointed out words change, we still dial our phones. How many people have had a dial on their phone for, Well, I mean, think about password complexity requirements, right?

Every CEO on the planet wants the, the highest degree of password complexity so that I can't get hacked until they have to change their password every 30 days and it has to be 15 characters long with four special characters, no repeated characters and no repeats of your password for the last seven years. And then they immediately go turn it off Or network access control and It, yeah, I can't see the server anymore, turn it off because I wanna be able to see this. But you don't need to see that ZTNA says you're not authorized to, doesn't matter.

I'm the boss. And that's usually where we start getting into those compromising situations, right? Is I've created a policy and everybody has to follow that policy except for me, because I'm different and special, I can totally run his route on my own box.

I know I'm not supposed to, but I know what I'm doing. How bad can it be? And we all know what happens at the end of that because that, just like every other story, the reason why those things exist, the reason why those policies are in place is to prevent careless mistakes from becoming massive disasters.

And you know, something as simple as accidentally publishing the wrong API key in a GitHub repo and now all of a sudden you have a $12,000 AWS bill next month. Well what if that API key was, I don't know, the IP address of a satellite imaging, uh, system that was, uh, flying over a terrorist camp in, in Africa. Now the DOD knows how to prevent that from happening, but does you know the contractor that just is getting paid $12 an hour to work on this stuff?

I, I don't have a good answer for that. Words mean things according to one of our great delegates, Justin Warren, and he's absolutely right. When we use a specific term to refer to some kind of a policy construct or physical security, we have to be sure that what we're doing is accurately describing the situation as it is.

And look, you've been listening to the on-premise it roundtable for years, so I will be the first person to argue with that, but sometimes we actually have to take a step back and ask what we're doing. And as I've said to a number of people, if you use a better term, an isolated network, a virtually isolated network, you're gonna get the point across. But unfortunately, that's talking to tech people who are very critical of poor word choices.

A lot of people who buy technology want to hear something cool. Military grade, um, advanced AI, quantum, you name it, whether or not it actually is, is inconsequential. If it has the right buzzword, people are gonna buy it.

And so the next time someone comes into your office and starts talking about air gapping something, my recommendation is to hook them up to a harness and dangle them into your server room. And if they can actually manage to hack into your servers, you probably need to have something that's air gapped. You should also call Tom Cruise because he's probably gonna have find a new stunt person that will just about do it for this episode of the Tech Field Day podcast.

I wanna thank everybody for tuning in. Uh, before we go, uh, people wanna find out more information about where you guys create content and share your things. Where can they go, Carol?

Uh, LinkedIn for me. Okay. LinkedIn and Blue Sky.

LinkedIn will work fine for me and we'll have, uh, links to their, uh, LinkedIn profiles in Blue Sky information and everything down in the show notes. Uh, we want to thank you all for tuning in. com/podcast.

com as well as on our sister sites Techstrong tv. We'll be back next week with another great episode. Until then, thank you so much for tuning in and make sure that you're sticking to the premise.