• 0 Posts
  • 32 Comments
Joined 9 months ago
cake
Cake day: October 19th, 2023

help-circle



  • TheOneCurly@lemm.eetoSecurity@lemmy.mlSecuring a computer?
    link
    fedilink
    English
    arrow-up
    1
    ·
    edit-2
    1 month ago

    Are you concerned about sensitive data leaving the PC or some sort of infection (like a crypto-locker) being brought onto it? Also, what is your threat level? Are you likely to be targeted specifically?

    With an airgap, it would be pretty difficult to get data off of it without being onsite. The most important things would be physically securing the device (locked room), using full disk encryption, and using some sort of 2-factor login system. (hardware security key, like a yubikey ideally).

    Securing against infection is nearly impossible, as stuxnet showed. Your best bet to beat these is some common sense security with what you’re transferring and lots of backups. If you do find an infection, you just blow the whole system up and restore from a clean backup.
















  • As I understand it, NAT is a firewall with only a very basic configuration: allow all outbound and accept only established inbound. If you don’t expect to have any incoming connections and completely trust all your internal devices then its good enough.

    However, if you start wanting to port forward for servers (SSH, FTP, video games) you need to poke holes in the NAT firewall and it has no additional configuration options to help you. The same goes for if you have internal (ex. IoT) devices that you don’t necessarily trust, there are no rules to block outbound traffic.