<i>&gt; My current recommendation for defending against strong attackers is my old approach: several cheap, hardened machines for physical separation with KVM switch; a guard for sharing between them; sharing done over non-DMA, simple interfaces with simple, easy-to-parse protocols.</i><p>Could you share more about the physical transport for sharing, the data guard (is that a separate box with a Live CD) and wire protocols?<p>How do you protect against physical threats to unattended devices&#x2F;data, e.g. do you have any form of trusted boot to verify the integrity of the BIOS, bootloader and OS?