The artificial air gap created by deploying firewalls

Typical IT illiterates bragging

The policy also requires any activity on the sole internet-connected system to be done "through an identifiable whitelisted device followed by scanning of both for any vulnerability/malware". Even that device can only connect to whitelisted IP addresses.

If India is able to produce a device detecting 0-day vulnerabilities, congrats.

That device is very simple, it has a red light that comes on when there is a 0-day in a piece of kit.

The light is, of course, permanently on.

Country that makes your firewalls = country that hacks stuff quite legally

You know these laws they pass that let them legally compel backdoors in any system, and legally hack any system, and then shortly after, they sign a cyber cooperation treaty so they can sell that as a service to their buddies worldwide. And then you go put their crap on your network? Knowing they can or already have backdoored it?? Do not do this.

It's not just 5 eyes countries, Australia and UK, its Germany too:

https://cpj.org/2021/06/german-law-government-surveillance-hacking-journalists/

("German law increases government surveillance and hacking powers, removes protection for journalists")

I was trying to figure out who was behind the Pandora papers, a country that hates the Czech President, hates Tony Blair, King of Jordan, has high taxes , is known for its hacking (Crypto AG + various Swiss hacks), was not featured heavily on the list, has a legalized hacking law and just had an election to make it more left wing.

Germany, fits that bill. I think they did it.

The motive would be to raise more tax in other nations, rather than lower it at home, and also take a big side swipe at the UK to ensure it stays "on message" regarding high taxation EU.

If it was a country, like Germany, then it represents a state backed cyber attack.

Loooool, tin foil hat much?

Yeah everything is back doored, or it isn't then its mirrored onto a dark fibre, no big deal the SNR is so high that unless your looking for something specific you won't see it, run wireshark/tcpdump on your desktop, then multiply that noise by every device on your lan, then multiply by every customer on your isp, then multiply by every isp and that's what nation state level network surveillance looks like...

Nope just bogstandard whistle blowing in my opinion, it's always someone about to get caught with hand cookie jar. Burn it all down then claim immunity

"Nope just bogstandard whistle blowing in my opinion"

Impossible. Coordinated leaks across 14 different companies? So 14 whistleblowers in 14 companies simultaneously and in coordination releasing their wares....

No way, it's a state attack. The question is which state.

I'm ruling out Russia because many of the leaders targetted are Putin friendlies. I ruled out China because the targets aren't their preferred enemies and includes Hong Kong. UK, the usual hacker? Nope, blantant attacks on UK leaders like Blair. Australia? Testing out their new legalized hacking laws? No, because they're in UK's surveillance group and UK was targetted. Israel? Attacking friendlies? No chance, too much risk of backfire.

Germany, ahhh.. yeh... I can see that.

It's not just the hack, its the propaganda op needed. Tony Blair buying a trust that owns a Marylebone office, instead of buying the office directly from the trust and incurring extra property taxes? I mean that's not a thing without the innuendo needed to pump it. Nobody pays more tax than needed. See IR35 contractors for details of that.

"Czech President buys 26 million euro property in Monocao via a trust", again, so what? He's a successful businessman worth billions and disclosed he owns hundreds of millions in property assets which must be somewhere! Without the innuendo of "didn't mention it [this specific property] on his political disclosure form".... to whom? The paparazzi? Monaco would certainly have him registered. When he goes to his holiday home, does he blindfold his security so they don't know where it is? It's ridiculous without the innuendo.

That's a state op.

More evidence popping up today pointing to Germany.

That global minimum corporation tax rate Ireland just signed up to was pushed by Germany and France:

https://www.reuters.com/world/china/germanys-scholz-greets-us-move-work-global-corporate-minimum-tax-rate-2021-04-06/

"I'm in high spirits that with this corporate taxation initiative, we'll manage to put an end to the worldwide race to the bottom in taxation," said German Finance Minister Olaf Scholz, a firm backer of the initiative."

German corporate tax is 30%, its the highest among the larger OECD countries. With only Columbia higher at 31%, and France only a little lower at 28.4%.

Total payroll tax among OECD countries... Germany is second only to Belgium. A clear incentive to try to force up taxes in other OECD countries.

Clear motivation there. Uncompetitive countries, drowing in taxes, trying to drag the other OECD members down with them.

Notice the low number of frenchies on the Pandora papers? Yet french property tax is between 7% and 10% of the purchase price... you'd think there would be a lot of French rich people simply wrapping property in trusts to be bought and sold freely, both in France and every other high property transfer country. Yet not in the Pandora papers.

The great wall of china was rendered useless when the baddies bribed a door keeper to let them in. I am expecting problems to occur because of human behaviour - "What harm will there be if I copy this amusing document around my work colleagues". I'll bring it in on a USB device.

Humans always are the weakest link. If the Internet-facing computers can only access whitelisted web pages, and if they are, essentially, on a private web, then there likely won't be very many amusing documents to copy to the colleagues.

Of course, said amusing document can always be mailed from home.

Glue gun the USB sockets if you give a shit, can be non destrucivly removed, cheaper and more effective than socket locks, ohh and put the padlock through the loop on the chassis lid...

But yeah pay the grunts enough to make bribes less attractive and make the consequences severe

This though is just a political greasy pole doc, for someone wanting a promotion, complete unworkable chod, maybe Amber "hashtags" Rudd took a consultancy gig and offered her insight here...

It sounds to me that something has already gone wrong, they've discovered it, and are trying to make sure it doesn't happen again.

Sounds, based purely on the article, like yet more "cargo cult science" (based on Feynman's description) as IT security.

Couldn't have said it better myself. This shattering advance is exactly the precautions I found in use, and helped implement repeatedly, daily for may years in the 1990s and 2000s. Mind you, I never did power stations.

Oh, the fun when we would find a WiFi hub sneaked into the secure zone for sysadmin's convenience, on the grounds that it was an air gap! Obtaining and installing patches at max speed was the usual excuse, but gaming engines often proliferated on the more favoured workstations...

" "The artificial air gap created by deploying firewalls

As several others have rightly indicated - a firewall is not an air gap.

However quite a lot of research has found ways of breaching real air gaps (commonly via infiltration of inconspicuous kit) so there is a genuine problem. To quote Major General Jonathan Shaw (Late Head of Cyber Security, MoD) “...about 80 per cent of our cyber problems are caused by what I call poor cyber hygiene.” That's commonly the greatest weakness, both against cyber attack and other accidents, and is how such infiltration takes place.

All you need is a removable storage device that jumps the gap. A colleague once set up a secure comms unit in a war zone. The red and black systems were the statutory 1 metre apart, but on returning a month or so later he found a USB stick hung from the ceiling between them on a length of elastic.