Schneier on Security

Clive Robinson • October 24, 2025 6:23 AM

@ tfb,

With regards to your question,

“How is this supposed ‘physical separation’ meant to work?”

You are only considering “distribution” and “feedback” which is at the very end of the production chain.

These are systems that are not really of interest to the sorts of attacker given in the article of,

“F5 said a “sophisticated” threat group working for an undisclosed nation-state government had surreptitiously and persistently dwelled in its network over a “long-term.” “

For the most part the “business”, “design”, “development”, “test” and “pack” stages of the production chain do not need connection to external communications.

For the few developers who might need access to online resources they can use separate computers on a physically and electrically/radio segregated network, so that an accidental or deliberate “reconfigure” would not bridge the networks.

Banks and financial houses were doing things this way back in the mid and late 1990’s without issue[1].

As @BCS notes you have to,

“set up some very specific processes for moving stuff around.”

Whilst not intuitive, it’s not rocket science either.

The hard part is actually “beating down” certain personality types. Firstly the MBA types trained on neo-con mantra. Secondly those “new thing” developers that demand “access to the world” for “reasons the cannot sensibly articulate”.

The sooner people accept that the “Cloud” and more generally the “Internet” is not just very high risk business case wise (lock-in effect). But both a security and surveillance nightmare the better.

Then carving the “cloud”, “External AI” and “Internet swamp” out of the organisation except in the very few places that the risks can be mitigated effectively is in most cases the sensible way to go.

[1] I contracted in to this area in the “City of London” for a short while “between more interesting permie jobs” and to pull in some money before three entirely predictable things happened,

1, The expected madness that was Y2K”
2, The culling that would follow Y2K
3, What the UK Gov later called IR35 was put in place.

It was obvious back before the 1990’s that Y2K was going to cause a bubble of contracting and an exponential rise in hourly costs via self employed “Consultants” working through a Ltd company for tax reasons. And that after Y2K there would be a revenge “blood bath” / culling by businesses of such people. Because for “money reasons” businesses were not spending on Y2K even in the early 90’s and way way to many of them were leaving it, to past the last sensible minute. As per what we would now call “neo-con mantra”, but back then “blinkered outlook”, or “short term thinking”. With the obvious “supply and demand” sending hourly contracting rates sky high and those tardy businesses having to pay through the nose and any other accessible orifice.

So it was obvious they would want revenge after the turn of the century. But Also people can be idiots. All those little one man companies were doing the “Loads of Money” idiocy that the “City Boys” had done in the 80’s… and they were putting porch cars on business expenses and in other ways living “Rock Star lifestyles” and not paying any tax, National Insurance, or much of anything else. So at what was drummed up politically as “living on the tax payer” (even though it was exactly what larger businesses were doing and still do).

So I decided getting my feet under the table, and well settled in as a permie, in a company where my abilities would be appreciated long after Y2K and wait it out was the sensible way to go untill contracting became viable again.