0:01

We all depend on interconnectivity

0:04

to get things done. Our

0:06

phones, our cars, wearable technology,

0:08

and at our jobs, especially

0:10

if they're technical jobs, it's amplified. It

0:14

feels like everything has to be

0:16

integrated. There's APIs, platforms that need

0:18

to talk to systems that we

0:20

never touch. But

0:22

in some industries, there's a

0:24

desire, or more like a need, to

0:27

have everything locked down, isolated.

0:31

That's because those industries may

0:33

deal in sensitive information, data

0:35

that a hacker would drool over. But

0:38

these environments still need to do the same

0:40

things that other environments do. They

0:43

still need to store and manage that data,

0:45

ensure its accuracy. They still need to

0:48

provide space for developers to create and

0:50

innovate. But how? And

0:53

what is it like to work in that type

0:55

of environment? This

1:00

is Compiler, an original podcast

1:02

from Red Hat. I'm

1:04

Angela Andrews. And I'm Kim

1:07

Wong. We go beyond

1:09

the buzzwords in jargon and simplify

1:11

tech topics. Today's episode,

1:13

we're connecting the dots on

1:15

disconnected networks. Angela,

1:21

in the spirit of being accurate,

1:24

I spoke to someone

1:26

who has expertise in

1:28

disconnected networks. Oh yes,

1:31

yes. I

1:34

spoke to Josie Pfeiffer, a

1:36

Red Hat consultant. She's based

1:38

in Europe. Josie focuses on

1:40

infrastructure and security. She works

1:42

with customers who use disconnected

1:44

open shift clusters. A

1:47

disconnected open chef cluster is basically

1:49

an environment that isn't directly connected

1:51

to the internet, so you can

1:53

also call it Air Gop. It's.

1:56

Air. Gap does that sound familiar? Angela:

1:58

That is the word that the buzz

2:01

air get. Yes, I'll admit I didn't

2:03

know a lot about air Gap Networks

2:05

when I was going into doing this

2:07

episode. K So I did some research

2:09

and I found a great article that

2:12

was written Actually buy another Red Hatter

2:14

architect Steven Wilson who I'll read from

2:16

the article. the article. And. Air Gap

2:18

network is one that is self contained

2:20

but has no external or internet. Connectivity.

2:24

Networks are often air gapped as

2:26

an extreme security method for government

2:28

or corporate projects that require confidentiality

2:30

or secrecy. In a nutshell, that

2:33

is a perfect definition for what

2:35

an air gapped network is. The

2:38

level of security and

2:41

privacy that you need for

2:43

an environment like this must be

2:45

high. You cannot

2:48

have some sort of external

2:50

threat coming into

2:52

your network. So you

2:54

have to coordinate off in such

2:56

a way that everything works within

2:59

but nothing from the outside gets

3:01

in unless it's absolutely purposeful

3:03

and with very good reason.

3:06

Right. Usually via sneaker

3:08

net. Sneaker net? Do you remember

3:10

sneaker net? No. Maybe.

3:13

Wait. Let's go back.

3:15

Okay. All right. Let's

3:17

go all the way back. So I know our listeners

3:19

here, when they hear the term sneaker net, some of

3:22

them are saying, oh, I remember sneaker net. And

3:24

then we have some folks that are like, oh, what's

3:26

sneaker net? Okay. So

3:28

back in the day, when you wanted to

3:30

take a piece of data or file from

3:33

one machine to

3:35

another and maybe they

3:37

weren't networked, maybe they were, but they

3:39

weren't on the same, whatever, you

3:41

would get up and your sneakers would

3:44

walk across the floor and you'd have your

3:46

little floppy disk in your hand and

3:48

you'd go stick it in the other

3:50

system. That's what sneaker net

3:53

is. Oh wow. Okay. So

3:55

you're just like hand walking it from one

3:57

computer to another. Basically.

4:00

And I didn't say floppies. Yes, he did

4:02

say floppies of wow. Okay, so our it.

4:04

I guess that and that that tracks with

4:06

some other things I was reading about. Air

4:08

Gap Networks okay or eight Sleep or net

4:11

As I say something today. He

4:15

thinks I understand why it that

4:17

sister as rak sister is a

4:19

group of nodes that are like

4:21

working together and impairment right? That

4:23

is correct. And now we know.

4:26

Disconnected Network or an Air Gap

4:28

network is a self contained network

4:30

that does it connect the internet

4:32

or any other outside networks. Faith

4:34

that is correct. So what's the

4:36

difference between a disconnected network and

4:39

I disconnected cluster? Well. This.

4:41

Is me guessing here and

4:43

but a cluster. Is. Disconnected

4:45

is it lives in a

4:48

disconnect network rights so it

4:50

can be. Clustered

4:52

meaning. It sharing

4:55

network and storage. Like

4:57

it's sharing resources together with other

4:59

clusters. Better in the same network,

5:01

you can have a cluster in

5:03

one network. And a cluster in

5:05

another network and never the twain shall

5:07

meet. Now and it's

5:09

something that's only done when

5:11

the utmost security is needed.

5:14

So. It's not something

5:16

you just do for fun

5:19

of saw mostly just because

5:21

these organizations are highly regulated.

5:23

So financial services companies are

5:26

insurance companies. Urbanization the time

5:28

sensitive. States are all sorts of

5:30

air for example. But here's the

5:33

thing. many of the same things

5:35

that are in. A regular

5:37

more like open network for network

5:39

was connected to a cloud server,

5:41

for example. Also need to

5:44

be in an air gap network.

5:46

He still have the same things that need to

5:48

be done. Does that make sense? The

5:51

same bells and whistles are happening and disconnected.

5:53

Networks that they are in, regular

5:55

networks that are connected to each

5:57

other, And the Internet. And right that

5:59

is. It seems to have to

6:01

do the things they saw the do

6:03

the things. they still have to store

6:06

data, they have to still do file

6:08

sharing that's usually done and he Ftp

6:10

or trivial file transfer protocol is healing.

6:13

File transfers in a server, A, clients,

6:15

and disconnected networks. There's other components like

6:17

web servers, dns, cetera. But what are

6:20

the difficulties here? Shows.

6:23

He says for the opensaf cluster.

6:25

Itself there is the inability to

6:28

get updates from an external source.

6:30

The. Cluster Com Phone home so

6:32

to speak you for example Com

6:35

Fats upgrades that you can just

6:37

poof issue routed through the series.

6:39

Good customer with them. have to

6:42

operate their own internal registry that

6:44

the closer can connect to we

6:46

want to you. Seen the latest

6:48

and greatest teams of security. To

6:51

make sure that you're not running

6:54

a system that has known vulnerabilities

6:56

in that sounds. You want

6:58

the latest features? Are you

7:01

happy? To

7:03

fix things that you need

7:05

for that, there's a platform.

7:07

upgrades fastest to run the

7:09

basic open chest. And there's

7:11

a catalogue which as far operators expressing

7:14

like the Ups or for open chest

7:16

where you can install all kinds of

7:18

out on stop trying on top of

7:21

open chest and that add more functionality

7:23

to the costs are. What

7:25

I saw. In a

7:27

disconnected environment. You. Still need

7:30

to have updates and the latest

7:32

and greatest operators and things of

7:34

that nature one an individual would

7:36

do in a disconnect in environments

7:39

they wouldn't say. well were disconnected.

7:41

We are unable to perform these

7:43

tasks. Know you're doing this your

7:46

own version of Sneaker Net. And

7:49

set of to your next door

7:51

neighbor you're going to Red Hat

7:54

and you're downloading this latest version

7:56

or this image and what you're

7:58

gonna. Do is your. Going to check

8:01

the have to that, You're going to

8:03

make sure that the contents that Red

8:05

Hat has said this is what you're

8:08

downloading. You're going to confirm that when

8:10

you downloaded. You. Are make sure

8:12

that that's the exact same pass that

8:14

Bread had his said if anything has

8:17

changed, say there was a man in

8:19

the middle, there was some sort of

8:21

nefarious behavior and you download said package

8:24

and you ran the has in the

8:26

house was difference. You'd never use it.

8:28

So there's this level of checking that

8:30

you would have to do when you

8:33

downloaded anything from somewhere else. to bring

8:35

it into a disconnected environment. you'd have

8:37

to make sure that the integrity of

8:40

said files. Would be what they said they

8:42

were. The integrity was still

8:44

intact. Before you brought. It in

8:46

to you're disconnected network. My

8:49

boots And try an analogy. So.

8:52

Let's. Say you did order something from

8:54

amazon. And. Your package arrives at

8:57

your doorstep. Than

8:59

you might like. Look up on the

9:01

edges and you'd see if someone killed

9:03

off the sticky tape. On ads on

9:06

that is basically the into a

9:08

teacher it seeing if someone tampered

9:10

with the perception of it's okay

9:12

to deploy and to the closer.

9:15

Well. The need for that layer

9:17

of security is clear to. You.

9:20

Me: Josie: A lot of people listening,

9:22

but just in case it wasn't this,

9:24

plenty of rules and compliance steps to

9:26

ensure that things are kept locked up

9:28

pretty tight. For. Financial

9:31

services companies for example, their regular

9:33

audits and they need to get

9:35

the rubber stamp that they're compliance

9:38

with certain standards. And that's

9:40

a tricky part because different countries,

9:42

different standards, different regulations to follow,

9:44

and the punishment can be severe

9:47

for companies that failed to meet

9:49

the criteria. So Switzerland

9:51

for example of for have

9:53

a strong national regulatory body

9:56

that imposes additional requirements on

9:58

top and. The com. of

10:00

not meeting them can for one be

10:02

financial and so there could be fines

10:04

if you don't meet them and

10:07

it could also mean that if you're

10:09

a bank for example that they revoke

10:11

your license to operate as a bank.

10:14

High stakes yeah very but

10:17

that's good right? Well

10:19

if you're an avid online shopper like me

10:22

it is. It's good to

10:24

know that these networks are in

10:26

place they're protecting your information. But

10:30

how does one ensure the data handled

10:32

within a disconnected network is accurate if

10:35

it's not able to connect to

10:37

another service to ensure that accuracy?

10:39

People aren't static and neither is their

10:41

information. A network doesn't

10:43

just sit on the data it needs to

10:45

move it around use it process

10:47

it update it when it's needed Josie

10:50

breaks down the concept of

10:52

mirroring something that happens often

10:54

and disconnected environments. So

10:57

mirroring is basically just taking

10:59

something that exists in this

11:02

public registry and putting it

11:04

one-to-one into your internal disconnected

11:07

registry. Then it will

11:09

take the release images and

11:11

operator images from our official

11:13

Red Hat registries and will

11:16

mirror them to an internal

11:18

registry. The cluster will expect

11:20

things to be at the

11:22

official Red Hat registry location

11:24

but through that mapping it

11:26

can then find them in

11:28

the disconnected registry. Alright

11:31

so this internal registry what

11:33

mirroring does is since it can't

11:35

get information from outside the network

11:38

it's taking something that exists and putting

11:40

it into an internal disconnected registry and

11:43

then the cluster will

11:46

find and correctly identify data through

11:48

mapping to that local registry that's

11:50

on-premises. That sounds about right. Bam!

11:52

I got it. It tracks. Yes.

11:55

Okay. Well Disconnected

11:58

clusters, air gaps in the. Work

12:00

Fair. Restrictive for very good

12:02

reasons. But as things

12:04

keep changing and tech said that

12:07

change how we think about them

12:09

up Next we further examined the

12:11

need for air gaps networking and

12:13

find out how shifts and available

12:16

sack may affect our feelings around

12:18

security vs. innovation. Sit tight, will

12:20

be back. We.

12:26

Left off with Josie explaining

12:28

the functionality of disconnected opensaf

12:31

clusters. But. It made me

12:33

think more broadly. It

12:35

all seems safe and invisible to bad

12:38

actors, but at some point the data

12:40

needs to be transferred into a public

12:42

cloud or some other networks in order

12:45

for it to be used effectively. and

12:47

there's still a layer of security there,

12:49

something that many of us are familiar

12:52

with encryption. Whenever you go

12:54

from Amazon and you put in your

12:56

current details for example, Because

12:58

for some time and processing service

13:01

in the background of service for

13:03

like after past p three orders

13:05

to be allowed to processor cards

13:07

a term they have to show

13:09

that they're a humbling your data

13:11

no secure away on that they

13:14

have encryption and between and the

13:16

network to make sure the card

13:18

numbers and just love trouble for

13:20

anyone. But. That's still up.

13:23

Quite a vulnerability to the data

13:25

is moving from the super secure

13:27

environment to a service. was attackers

13:29

just kind of congregate in places

13:31

where the air gap soft and

13:33

the services began. It kind of

13:35

reminds me of my heroes season

13:37

Eight. He said the season malware

13:40

and a lot of the attacks

13:42

that be covered in that season

13:44

they all took place at kinda

13:46

like the point that's nearest the

13:48

user themselves and that's because of

13:50

the lot of. the access to talk

13:52

to flat seasons they said as that's kind

13:54

of like the point of vulnerability that a

13:56

lot of bad actors identify some in not

13:58

necessarily these like people have

14:01

this kind of very glamorized image of

14:03

hacking where people are hacking into these

14:05

super secure environments. But in all actualities,

14:07

these people are very smartly, if you're

14:10

thinking about it, they're going for the

14:12

weakest link in the chain. You couldn't

14:14

have said it any better. It's literally

14:16

the weakest link in the chain and

14:19

it's usually the end user. Yep.

14:22

You know, the company that

14:24

has their data moving in

14:26

this air gapped environment, they

14:28

can't control what's happening on

14:30

a client. So the best

14:32

way to do these

14:34

nefarious things is the low

14:36

hanging fruit. Yeah. Go to the end

14:38

user. They don't have what

14:40

these huge environments have. They don't

14:43

have the networking team and the

14:45

security team and the DevOps

14:47

team and the OpenShift team. They

14:49

don't have all that. They have

14:51

their little computers and, you know,

14:53

who they bought them

14:55

from gave them 90 days worth of

14:58

antivirus and spyware. We're

15:00

just trying to do our best out here. Definitely

15:03

the weakest link. Yeah. And

15:06

there's the issue of convenience and

15:08

ease of use, right? The data in

15:10

these networks and clusters are used for

15:12

businesses, businesses that need to be able

15:14

to move fast for customers that aren't

15:17

as security focused. I know

15:19

for me, I just want my shoes. I

15:21

don't really think about, you know,

15:23

PCI and I mean,

15:25

I should and you shouldn't have to. No,

15:28

like, I mean, like as a technologist, I

15:30

feel like I should as a consumer, you

15:32

know, I just want my shoes. I'm not

15:34

really thinking about the part that security and

15:36

encryption and disconnected networks play in my online

15:39

retail therapy. And you just said a

15:41

lot right there. We should be thinking

15:44

about it because we

15:46

are putting our information,

15:48

our financial information into

15:51

some box on

15:53

a browser, right? On

15:55

some network. If we're home, we probably

15:57

have a little bit more security. heaven

16:00

forbid we're sitting in a coffee

16:03

shop on some free Wi-Fi without

16:05

a VPN. Don't

16:07

get me started there. Looking to my left, looking

16:09

to my right, trying to avoid your gain. Exactly.

16:13

We have a part to play. You

16:16

know, the URL. Is

16:18

it the little lock on it? Is it

16:20

encrypted? That's the small part. You

16:22

know, do we have a VPN on? Are

16:24

we better off

16:26

using our phone as a hotspot as

16:28

opposed to using some free Wi-Fi, you

16:31

know, on the on the back of

16:33

a refrigerator somewhere. Like we

16:35

should be more mindful of

16:37

the part we play in

16:40

securing our data. I

16:43

want to step even a little bit further

16:45

back from like the end user or the

16:47

end consumer and talk about businesses and people

16:49

who are providing services directly to users. Like

16:51

if you have a store, if you're selling

16:53

the shoes to me, if I'm buying the

16:55

shoes from you, how much knowledge

16:57

and how much kind of consideration should

16:59

you be giving to these types of

17:01

situations? That's interesting because

17:03

now there are a lot of companies

17:06

who focus on just that. On

17:09

the transaction, on moving money

17:12

from one person's account to another.

17:15

And those businesses are hired by

17:17

maybe the smaller business to take

17:19

some of the onus off of

17:21

them. So are we writing the

17:23

code for protecting people's data? No,

17:25

we're going to enlist the help

17:27

of someone else. But there are

17:29

things, you know, me as the

17:31

small business owner, what can I

17:33

do? Are the systems

17:36

that are running my whatever, are they up

17:38

to date? Are they on the latest versions

17:40

of software? Are the workstations

17:42

and kiosks, you know, in my business,

17:44

are they up to date? So there's

17:47

a lot of moving parts. And

17:49

there are a lot of people who need to

17:52

be a part of this

17:54

solution as opposed to being a part

17:56

of the problem and saying, well, not

17:59

my problem. No, we all have

18:01

a part to play in that. I

18:03

like that. Not passing the book. No. Either

18:06

to the customer or to like a larger

18:08

kind of like enterprise level tech company. I

18:10

feel like it's a shared responsibility when you're

18:12

talking about security. It is. Yeah.

18:15

So we want to do that retail therapy.

18:18

We're going to make sure that the site

18:20

that we go to and put in our

18:22

credit card information is encrypted. We're

18:24

not going to be like, this is such a

18:26

deal. And

18:28

not do some hard due diligence and

18:30

start typing in those 16 digits. But

18:33

Angela, my shoes though. That's where

18:35

things go wrong. Yeah. Okay.

18:38

All right. I got to show some restraint. I have

18:40

to put my own credit card information before these pumps

18:43

that I really like. Okay. That's

18:45

fine. Little bit. Okay.

18:49

But, you know, I started

18:51

thinking about the future and obviously

18:53

everyone in tech is always looking

18:55

ahead. Right. Always. And

18:58

in this room for further advancement within an

19:00

air gapped environment, I imagine it

19:02

to be with this restricted environment by

19:04

default. What does it

19:06

mean for technologists that work in

19:08

these spaces? How can they be

19:10

more innovative, like looking forward? So

19:13

the client I'm with at the moment actually is

19:15

already experimenting with AI. And

19:18

you can either create your own

19:21

models based on the data in

19:23

those disconnected systems and then use

19:26

them in there. Or there

19:28

are some really cool open source models

19:30

that you can just put in there

19:32

and maybe train them with data

19:34

on top of that as well. That's

19:37

really interesting to me. Yes.

19:39

So again, if you're introducing

19:42

something that's outside of your

19:45

disconnected environment into your disconnected

19:47

environment, there has to be

19:50

some analysis and

19:52

checking in place. And

19:54

as we're hearing about data and

19:56

AI, we need to know where

19:59

this data is coming from. Right? So

20:01

being able to trust the source. How

20:04

are we vetted? How is that

20:07

being vetted? And because this is

20:09

such new technology, there's so

20:11

much more growth that's going to be happening.

20:13

And we'll hear more and more about this as we

20:15

go on. Yeah. Josie

20:19

thinks that that's a long way down the road. And to

20:22

your point, Angela, this is all very new. We're not

20:24

quite there yet. I'm

20:27

still a bit skeptical of how

20:29

much can be automated directly with

20:31

AI. If we think of

20:33

a very classic use case

20:35

that the user opens

20:38

a service desk ticket because something

20:40

isn't working. At the moment, I

20:42

don't really see AI being able

20:44

to work with a

20:46

lack of information still. So

20:49

if I just think about some

20:51

service desk tickets, I generally get

20:53

it's usually lacking a lot of

20:55

information and context. If

20:57

I think I'm putting in a query to AI

20:59

and I want AI to

21:01

solve my problem for me

21:03

efficiently without giving additional information,

21:05

then I don't think that's

21:08

very realistic at the moment. So

21:11

don't you worry. We're still

21:14

going to need, at least in

21:16

these disconnected networks we're talking about today, we're still

21:18

going to need a lot of really great people

21:20

to solve problems. That's not going

21:23

away any time soon. No. If

21:25

anything, this is a burgeoning

21:27

field of study. This is

21:29

where people can start making

21:32

their mark and understanding how

21:34

do we bring this new

21:36

technology into these types of

21:38

environments safely and

21:40

securely with reliable data.

21:43

I think we're at the tip of the

21:45

iceberg. There are going to

21:47

be pretty smart people out there trying to

21:49

solve this exact problem. It's

21:52

just a matter of time to see

21:55

how effectively that problem is solved and

21:57

in which Use cases this can be used.

21:59

used for are so. Stay tuned.

22:02

We're not there yet. so everyone stay

22:04

put. You know we don't have to

22:06

worry about the robots just yet. not.

22:08

You know that we're always improving and

22:11

heading toward. What she's mentioning, Before.

22:16

We parted ways. I asked to

22:18

the what she likes about working

22:20

and these super restrictive environments. Despite

22:23

the difficulties and inconveniences, she says

22:25

working around restrictions can actually help

22:27

people to become creative problem solvers.

22:30

I. Think you have to be

22:32

a nerd for a to be

22:34

rewarding. Just enjoys solving problems and

22:37

interesting ways and using. Technology.

22:39

To find new ways to

22:42

solve problems. Chelsea. Is

22:44

just the type of technologist that

22:46

I absolutely. Adore! Really, they

22:49

are. Creative. They're

22:51

curious, they liked to solve

22:54

problems, and it's all about.

22:56

Working smarter, not harder. I

23:00

didn't know a lot about disconnected

23:03

networks. Word this cut it open

23:05

surpluses before I started digging into

23:07

the research. and there's a cyber

23:09

security kind of aspect. There's these

23:11

assets as environments for engineers and

23:13

developers said spur innovation sake and

23:15

said we make sure that like

23:17

the people are security for this

23:19

across not just a network but

23:21

also cross entire kind of ecosystem.

23:23

An entire experience like for a

23:25

customer of right and customer to

23:27

have their data as he protected.

23:29

There's so. Much to say again to

23:32

in this episode of so the whole nature

23:34

of it is kind of like a Black

23:36

Labs and the sneaker net and the very

23:38

kind of practical aspects of. Having

23:41

these kind of lock down isolated

23:43

systems but then knowing that these

23:45

systems exist to house day as

23:47

that's very sensitive but there needs

23:49

to be consideration for what happened

23:51

said data. Once it's be that

23:54

environment I feel like there's a

23:56

lot for technologists is still think

23:58

about and discuss and. They'll try

24:00

to like wrap their heads around even

24:02

though. And sure that the systems like

24:05

these have been around for forever. I'm

24:07

sure there are a lot of

24:09

our listeners who aren't familiar with

24:11

air gap environments in this is

24:13

yes, their first foray into this

24:16

topic. I'm hoping we have listeners

24:18

that work a nice air gap

24:20

environments and they have a lot

24:22

of experience is that maybe even

24:24

those who work in traditional environment

24:27

they can probably share it so

24:29

I'd like to hear from both

24:31

sides. what are your thoughts on

24:33

this episode? my folks working and

24:35

air depth environments? What. Are some

24:37

of the behaviors that people in

24:40

traditional and Burma's could take from

24:42

air gap environments: Anything that you

24:44

listen to and learned and enjoyed.

24:46

Or maybe eyes were open to?

24:48

We'd love to hear it, so

24:51

hit us up on are so

24:53

shows at Red Hat always use

24:55

the hashtag compiler Podcasts Let's talk

24:57

more about these disconnected environments I'd

24:59

like to hear. You have to

25:02

say. And. If you

25:04

are a part of the team that protects me

25:06

and my data on something for my. Seasons. I

25:08

salute you. And

25:16

that does it for. The episode of

25:18

Compiler Today's Produced By Me.

25:21

Ten walks with Johan, Philippines and

25:23

Kirilenko. I said thank you to

25:25

our guests Chelsea Pfeiffer and a

25:28

special shout out to Steven Wilson

25:30

says article on Disconnected Networks to

25:32

help save this episode. Victoria.

25:35

Lawton loves a good integrity

25:37

check. Special. Thanks to

25:40

Brett doesn't are audio engineer

25:42

is Christie said. Are

25:44

Thieves. I was composed by Marianne. Shudder.

25:47

Are all Your Team

25:49

Includes: Brent Seminole Leave

25:51

Day Stephanie Wunderlich might

25:53

As Sir Nick Burns

25:56

Aaron Williamson Parenting Gera

25:58

Know Rachel or Tell

26:00

Devon Hope Mike Hampton

26:02

Ocean, Matthews Cage Johnson,

26:04

Alex Trouble Seat and

26:06

The Mystical Mira. Cyril.

26:09

If you like today's episode means that don't

26:12

keep it to yourself Father So rate the

26:14

show and leave us a review on your

26:16

platform of choice. Chat with someone you know.

26:18

it really helps us out. Thank you so

26:21

much for listening. We'll see you next time.

26:23

The I was the on the sneaker net.

26:27

The Firebird wasn't theory, but.