[martinced]

You need two networks: one internal without any Internet connection and computers with no WiFi and no USB.

Make people work on their workstation, connected to the internal network and let them use their other computer / laptop to search the Web.

I can name at least one very important chip-designing company that is worth $$$ bn that used to work this way (don't know where they're at now).

[betterunix]

I am not sure partitioning networks the way the military does is going to work very well. What is going to happen when a mid-level manager has a meeting, he is running late, and he just needs to get his powerpoint set out of the internal network? He's either going to miss that meeting or fail to close the deal, at which point the policy is getting in the way of business (and will therefore be short-lived), or he's going to find that one crack that lets him get some data out (more likely).

The reason red/black networks (can potentially) work in military environments is that there is a (somewhat) uniform notion of classification in the military; in the business world, there is no such thing. What is needed is something more distributed, like a system that automatically encrypts documents so that uploading those documents to some Internet service is not so hazardous. Give employees smartcards that are easily carried around and easy to use, perhaps combining those smartcards with a thumb drive that contains whatever software they need to decrypt their documents on any computer. The security will not be perfect, but this is not a situation that requires perfection, only improvement.

[capnrefsmmat]

I work at a facility where all web browsing must be done through a remote desktop session to a server connected to the exterior network, which is reimaged regularly.

Unfortunately they don't keep software fully up to date on the remote desktop server, so the security benefits are lessened. But malicious websites have no way of stealing your secret files.

[betterunix]

Unless there is a bug in your remote desktop client that can be exploited by a compromised server...

[ubique]

I interned at an outfit like that a long time ago. It sucked then and would never work now in the age of smart devices. Unless of course these devices were banned from, or confiscated on entry to, the workpla^H^H gulag.

[peterlalonde]

I don't think I'd want to work in a place like that.