I am speaking from experience on non-NSA programs.
It goes without saying that their entire operational network is firewalled with an air-gap. If a user needs to have internet (or other extranet) access from the same desk as their operational network, they will have an entirely separate terminal for it, they may even have rules that require a minimum distance between the two terminals.
It goes without saying that their entire operational network is firewalled with an air-gap. If a user needs to have internet (or other extranet) access from the same desk as their operational network, they will have an entirely separate terminal for it, they may even have rules that require a minimum distance between the two terminals.