Using security domains is something you need to consider consciously now
that we’ve gone through many ways of implementing them
with isolation and compartmentalization.
You should consider how to partition your domains.
It might be just as simple as having a work domain and a personal domain,
or a trusted and untrusted domain.
The domains will be based on the risk,
the consequences and your adversaries and you threat model.
Let’s talk through some examples based on various different use cases.
Let’s say a person wants a usable and easy operating system,
an environment when performing most tasks like creating documents.
They don’t want to be overly burdened by security.
In this case, they may use Mac OS X on a laptop
with all of the uncumbersome security settings set.
At the same time,
they want a high level of security against malware
and hackers while using the internet,
such as browsing the web, downloading files, etc.
So they elect to have a high security domain for this.
They use a lockdown virtual machine
running Debian to enforce this security domain.
VirtualBox is used as the interface between those two domains.
Perhaps someone is concerned about privacy and local forensics.
They have a separate secure laptop
which is kept in a physically secure location when not used.
They run Debian as the host OS and Tails through VirtualBox.
Perhaps a person's concerned about tracking and hackers,
but wants to run games on their machine.
They have a Windows host for all non-internet activity
and they use a live operating system like Knoppix for using the internet.
Maybe someone wants the least burdensome isolation for browsing the web,
so they use Windows and just sandbox the browser.
That’s the simplest isolation solution they can come up with.
Maybe a person is concerned about a nation state-level adversary,
they might use a secure laptop with Qubes
and Whonix especially configured for their needs.
For travel, I have a high need for privacy
because I could be carrying confidential documents from blue chip companies
that could cause reputational or other damage.
I use a separate physical laptop
with no sensitive data on it at all when I travel.
If I do need to access anything sensitive,
I place it encrypted in the cloud with dual-factor authentication,
so if my laptop is seized,
nothing can be forensically taken from it as there is nothing on it.
And this has been a potential scenario
because I’ve worked in locations where the oil and gas industry is,
and some of those are pretty much the Wild West.
Within each security domain you would also enforce
all the other security controls detailed throughout the course.
If you look here, you can see a diagram,
this is from an article written by Joanna Rutkowska,
who’s the Qubes OS Project Lead.
This is a more complex setup for using Qubes.
Each of the different colors represents a level of trust,
black being the most trustworthy and red being the least trustworthy.
So you can see how she’s got domains here,
the most trustworthy, the vault which contains master PGP keys,
keypass, and has no network connections.
So she’s copying and pasting from those domains into the other domains.
Then moving down in trust is the Qubes dev stuff,
the code, the signing,
and over here this is very personal, so personal email,
personal PGP keys,
there’s various work activities on other domains,
work admin,
and then through to the least trustworthy,
which of course is browsing the web and untrusted apps.
So these are separated into different security domains
and different VMs within Qubes.
And then you can see here the interfaces between those domains.
So this is obviously the sort of thing that you do
when you want to take it to the next level, really,
in terms of your isolation and compartmentalization.
So I hope that gives you an idea
of what different security domains you might need
and use depending on your situation,
to help you protect you from your adversaries.