Since 2008 or so all US government computers on SIPR block USB storage devices are unless they are on an approved list. Autorun is disabled.
Physical security is another big factor, there is a long checklist for a SCIF that at some level takes into account TEMPEST type threats that mitigate many attacks on air gapped systems.
And none of these things are the default on commercial software because users want it to be frictionless. They want software to install right away when you plug in a usb drive, etc.
I don't think that would have protected against this attack. I think it was the users' workflow to plug USB drives into non airgapped computers, then into the airgapped computers. So those USB drives would be put on the approved list, and also be used by the attackers.
Would you agree that perhaps executables whose origin is a usb drive should be treated as equivalent to a browser download and unconditionally get a prompt to execute even if it was copied off the usb? I think it’s naive to think that our own security wouldn’t be helped by improving software measures even if it does risk our own offensive capabilities - we have very advanced and well funded adversaries ourselves
Getting the balance between security and usability right is tricky. It doesn’t make sense to have to click yes to trust software when you run it a hundred times a week, pretty quickly you are just clicking and not actually considering the risk. At the same time, for an airgapped systems where updates are rarely installed and the impact is much higher it makes sense to only allow whitelisted software and prompt each time
It does prevent you accidentally running something that you didn't expect to be an executable in the first place as is the case here. I doubt you're running executables off of USB drives hundreds of times a week on air gapped machines.
Physical security is another big factor, there is a long checklist for a SCIF that at some level takes into account TEMPEST type threats that mitigate many attacks on air gapped systems.
And none of these things are the default on commercial software because users want it to be frictionless. They want software to install right away when you plug in a usb drive, etc.