We just talked about physical isolation and the need for it, 2
now some virtual isolation and compartmentalization methods 3
that you can think about and potentially use yourself if you need to. 4
First is with encryption. You can use compartmentalization with encryption, 5
and you will with the protocols that you're using. 6
So here are some examples of how you might use compartmentalization, 7
virtual compartmentalization with encryption. 8
You can separate data by its level of importance, 9
or you can separate your assets by their level of importance by having, 10
say for example, one encrypted volume for confidential data, 11
one for secret data, and one for, say, top secret data, 12
and use different encryption keys for each of those volumes. 13
You could use a storage device like a NAS with separate volumes, 14
each encrypted with a separate key. 15
I have a NAS storage device with separate encrypted volumes. 16
The secure volumes are virtually never mounted 17
and decrypted because I don’t need to access them very often. 18
The day to day volumes are used for less secure, less secret data. 19
This is a good method of virtual isolation 20
to reduce the attack surface of the secured data. 21
If, for example, I had some sort of randsomware, 22
those drives are not mounted in order to be attacked. 23
The encryption key isn’t in memory 24
because the drives are not mounted. 25
A form of virtual isolation with encryption. 26
You can use hidden encrypted volumes to make your data harder to find. 27
And you’ll find when you're using transport security, 28
use of separate session keys 29
for encrypted messages like with Elliptical Curve Diffie-Hellman 30
for perfect forward secrecy is an example of compartmentalization, 31
separate sessions using separate keys. 32
We talk more about encryption in other areas of the course. 33
We have a section on File And Disk Encryption, 34
which covers more of this. 35
Another tool for virtual isolation is the portable app. 36
For Windows, these can be downloaded from this site here, 37
portableapps.com and also pendriveapps.com. 38
Portableapps has about 300 portable apps, 39
so it’s quite impressive what you can download from there. 40
And you can see Firefox, Thunderbird, Chrome, Skype. 41
These can be used with Linux, Unix, and BSD via Wine, 42
and Mac OSX via Crossover, Wineskin, Winebottle, and PlayOnMac. 43
If you're not familiar, portable apps are standalone applications. 44
They are self contained and don’t require an installation. 45
When you install an application, such as a browser, 46
the application files are stored in various locations 47
over the file system, and changes are made to the registry. 48
With portable apps, 49
all changes are contained to a single folder or file, 50
making the application portable. 51
So you can literally copy it, paste it somewhere else, and it’ll still work. 52
That’s not the case with installed applications. 53
You cannot just copy and paste them and then they’ll work. 54
Portable apps have several benefits 55
for security, privacy, and anonymity, 56
and not many people take advantage of them. 57
So let’s go through some. 58
So let’s imagine we’re using Firefox as a web browser. 59
Data related to the browser history 60
is contained within the portable app. 61
This makes evidence concealment and elimination easier. 62
The application could be placed on a physically secure device, 63
like an encrypted USB such as this one, 64
so that it can be moved, it can be hidden, it can be destroyed. 65
The application can be placed on an encrypted volume 66
or even a hidden encrypted volume. 67
This means that unless it’s unencrypted, 68
the application’s data is inaccessible. 69
The application could be placed on both a physically secured device like this one, 70
and within this device, put on an encrypted hidden volume 71
making a pretty stealthy app with its data self-contained. 72
And you can have multiple instances of the application. 73
You can just copy it, paste it, and you’ve got a separate instance, 74
and you can create separate versions of it, 75
separate security domains, separate profiles, separate aliases. 76
So, if we’re going back to the example of the browser, 77
you could have multiple profiles of that browser 78
with different security extensions installed. 79
The applications can be used on other machines, 80
enabling you to use a secure application like a browser on another machine. 81
You just take along your USB stick 82
and plug it in the other machine and you’ve got your secure, 83
hardened Firefox on another machine as needed, 84
or whatever application it is that you're using. 85
Admin rights are not needed to run the applications, 86
so you can run them on systems you don’t own. 87
They enable plausible deniability. 88
So, let me give you an example. If you have a standard installed browser 89
used for normal, non-private browsing, 90
and you also have a second, hidden, portable browser 91
on an encrypted volume for private browsing, 92
your normal browser would be clean 93
and available for forensic examination 94
and will contain a full browser history. 95
The portable app browser will remain hidden away and unknown about, 96
giving you plausible deniability 97
based around the evidence on your browser. 98
You can store portable applications in the Cloud. 99
So you could put them with a file syncing service, 100
and then run them remotely over the internet 101
on any machine that you decided to go on, 102
meaning that your application isn’t even 103
installed locally or even remains locally. 104
This gives you physical isolation as well, 105
potentially making your application 106
out of the physical geographic sphere 107
of influence of your adversary. 108
So, as you can see, some solutions provide both virtual 109
and physical isolation and compartmentalization. 110
Another example of this is applications as a service. 111
For example, webmail. 112
With webmail, all data can be stored with a third party 113
potentially helping someone store their data 114
out of the sphere of influence of their adversary, 115
creating physical and virtual isolation. 116
You can even browse the web via remote services, 117
preventing exploits from propagating back to your machine. 118
There’s no real name yet for these as they are relatively unadopted 119
but are a good solution for security. 120
I call them, personally, Cloud Browsers. 121
Here is one example here: Authentic8. 122
Maxthon’s cloud browser is another option. 123
Spikes has something called AirGap, which is the same sort of solution. 124
And there’s also spoon.net which have their browser, Sandbox. 125
And if you go down here, you see you can 126
various different versions of browsers, 127
giving you both virtual and geographically, 128
physical isolation and compartmentalization. 129
These will protect you very well from hackers and malware 130
as they cannot propagate to your machine 131
by creating that virtual and physical isolation, 132
but are a privacy concern and anonymity concern 133
as they obviously own the browsers, they own the infrastructure, 134
so they know where you're going and what you're doing. 135
So unfortunately, good for security, good against hackers and malware, 136
not so great for privacy and anonymity. 137
Another isolation method that you can use is remote access. 138
You can use terminal services, remote desktops, 139
Citrix, TeamViewer, SSH, VNC, Remote Desktop Manager, 140
XenDesktop, Citrix Receivers, XenServer, and so on. 141
With these, you control a remote machine. 142
This remote machine performs the tasks for you 143
and you just get the visuals back of what that device is doing. 144
This isolates you from potential threats 145
in the same way the cloud browsers do 146
because you are only viewing the desktop. 147
Malware can’t propagate to you via screen update. 148
So that’s an option for you. You can set up your own remote access software 149
on your own server for isolation. 150
You could do that remotely if you have your own virtual server. 151
I personally have a XenServer local to my network, 152
and one of those VMs acts as a browser 153
which gives me virtual isolation when I’m browsing the web.