|
Posted by Flash Gordon on July 20, 2006, 5:49 am
If you were Registered and logged in, you could reply and use other advanced thread options
> Hi all, need an "experts-eye" on a situation at work.
>
> I work in an environment whereby machines are approved to store
> information at varying levels of classification.
>
> To investigate a potential security problem, the hard disk of a machine
> at security level "2" was connected directly to a machine at security
> level "3" in order to establish if information at level "3" had
> inadvertently been stored on that machine. Windows search was used to
> establish all files modified since the date of the suspected transfer,
> and this indicated that no files had been transferred.
What if a file had been transferred and then deleted, in which case
Windows search would not find it but the data could still be on the
disk? I would also be concerned if I was the security officer that you
suspected there was a route where by such a transfer could have occurred.
> Our security advisors now say that since the disk at level "2" had been
> connected to a machine at level "3", it must be now be treated as level
> "3", since:
>
> "electronic handshaking will have taken place so they can talk to each
> other and that data concerning those handshakes may contain blocks of
> data at level 3"
>
> I don't really believe this. Yes, I understand handshaking may happen,
> but question whether user-data gets passed in the process, and also
> question whether this information is written to the disk platter
> itself.
>
> I'd really appreciate anybody's opinion on whether the above transfer
> mechanism actually exists.
Can you prove that it did not? Depending on the level of security you
are trying to achieve (and any external security standard you have to
meet) the rules could easily err on the side of precaution. I've
certainly come across such rules.
--
Flash Gordon, living in interesting times.
Web site - http://home.flash-gordon.me.uk/
comp.lang.c posting guidelines and intro:
http://clc-wiki.net/wiki/Intro_to_clc
| 
XML site map