So the only thing missing to do this is to have the technical knowledge yourself, know someone (which poses a security risk), or hire a company, which again can lead to a security breach - what do you do if you don't have the technical skills?
A service model. It's a matter of trust - towards lawyers, accountants, bankers, MDs etc. and nowadays engineers.
We are technology dependent but we live in society; hence, boundaries of security model don't end with technology as hostile actors defined by your threat model are always physical persons - the analogous concept to UBO and usufruct.
Optimum is to know the logic and perhaps certain procedures in order to be able to make informed decision - what do you need and from whom to procure and above else, whom to trust - and control performance. Every service provider is bound by means but not performance. Those means are a metric of trust.
The best is that you are competent and able to establish, maintain and develop your own infrastructure and OPSEC.
The key is redundancy and resilience - don't put all eggs in the same basket - analogous to have a holding with plethora of operational companies in different jurisdictions that have multiple accounts with multi-currency option.
I did see this post but forgot to give a proper response. My 'home network' uses a mesh network for WiFi, while my 'office' network is physically segregated with all connections via UTP. The critical data is stored in my 'office' network, so by gatekeeping these segments, I maintain a sufficient level of security. Yes, I have considered using multi-WAN and putting it all behind the same perimeter device, but for multiple reasons, I decided against it. However, I'm thinking about setting up additional logging and monitoring for the 'home' network, though I'm still figuring out how to implement this. So, I might take your suggestion and have the networks share the gateway. That would also mean I need to upgrade the firewall hardware to support IDPS + DPI to handle the full bandwidth.
@0xDEADBEEF approach differs only in matters of operational aspects, not the concepts - we can discuss operationals, but it will always be related to preferences and conditions
I would comment two things though.
WLAN and it's mesh set-up is acceptable for any network where no protected information with above private classification are exchanged between users in cleartext; in your case "home" designation with obvious meaning. In this context, I certainly assume that WLAN has appropiate encryption WPA3/WPA2 but the actuall protected information are separately encrypted.
Shielded network cables should be used whenever possible, not just because of TEMPEST.
As for proposition about HW firewall, I'll send a DM so we don't "spam" the thread - I was already "accused" by some satellite bot of spamming
Logging
It's somewhat misunderstood topic, good that you mentioned it as that is actually the core of OP's topic.
Beware of marketing about encryption and logging. There is symetric and asymetric encryption - hybrid, zero-knowledge and any other fancy wordings are just that - wordings. As for logging, depends what is assumed as logging. Every POSIX O/S deployed as server has logging capabilities. Those capabilities called daemons register and store attributes for different system and network components - user, kernel etc.
There is no need for those inherent system logging capabilities in POSIX O/S, but they are actually usefull when diagnostics is required as problems are real - there is no failure free design and operational system in the wild.
There are commands that can be executed within shell scripts as cron job and their output piped thru network or stored locally. This is how Wireguard was invented - it was used as a root-kit network capability
that was never uncovered on infected/targeted systems.
Hence, logging is quite an ambiguous word. Never believe service providers - perhaps, they themselves don't know or can't comment about the logging, but that is entirely different topic and not a public one.
Regarding OP's topic, I would quote myself, by logging and locating, end users are denied of anonymity, privacy and confidentiality thru persistence of their antipods.
i think you guys are making some things far more complicated then actually needed.
sure, all that makes sense to a certain extent, but then again you are using their silicone and all that stuff won't actually help.
for reference check
Elbrus-8S - Wikipedia
i am sure it won't outperform Intel/AMD in any way or form, and develop cost a fortune. there was a reason why they did it, guess what was it
@sergeylim88 mentioned sillicone
which is even more related to OP's topic.
Every server machine is controlled via out-of-band management interface (IPMI, iDRAC, iLo etc.) that has it's own SoC - in server machines' case, BMC. Whether smart objects communicate with their vendors and operators thru in-bound or out-bound channels, they must - in order to provide a designed service.
Those smart object are designed with ergonomy and life comfort aims - which they mostly achieve or I would be doing house and air cleaning, but their design concepts allow the misuse.
Personaly, I don't use or disable MIC if smart objects have it - don't use any voice assistant - or CAM.
i fully understand your concern.
question is what kind of privacy are we talking here, are we talking about sharing some anonymized data, or actually sharing your personal data/files.
Good point, but it all depends on you threat model. The bottom line is whether you are protecting yourself and associated data-sets from corporate vultures or highly qualified adversary with destructive interests.
This brings us to the CIA triad, a fundamental concept in security that stands for Confidentiality, Integrity, and Availability. Confidentiality ensures sensitive information remains protected from unauthorized access, maintaining privacy. Integrity safeguards the accuracy and consistency of data, preventing unauthorized changes. Availability guarantees that authorized users have reliable access to information.
View attachment 6768
I can guarantee that if you implement your controls effectively to uphold the CIA Triad, you'll automatically maintain a sufficient level of privacy.
Those concepts require high knowledge, budget and infrastructure which brings back the
@JohnLocke question quoted first.
