Physical Security and IT Concerns

Is Physical Security An IT concern?

• Securing a network from cyber attacks requires hard work
• This is done using redundant layers of antivirus programs, firewalls, and intrusion detection systems
• These measures protect against every possible electronic method of entry
• An attacker gaining access to the server room or network wiring closet raises questions about network safety

Physical Security

• The use of physical measures to protect valuables, information, or access to restricted resources
• Location protection involves physical barriers like locks
• Physical intrusion detection involves detecting unauthorized access
• Hardware attacks can target hard drives, network adapters, memory chips, or microprocessors

Locks and Safes

• Mechanical locking devices protect access to buildings, vehicles, and containers since ancient times
• Locks are used to secure physical locations where computers and digital media are stored

1860: Yale Pin Tumbler Lock

• Modern version of the Egyptian single-pin design
• Locks utilize two pins for locking
• This uses the double-detainer theory of locking
• The design creates a shear line

How Pin Tumbler Locks Work

• Without a key, pin stacks are pushed down by springs
• The driver pins span the plug and outer casing, preventing rotation
• With the correct key, ridges push up the pin stacks, aligning cuts with the shear line
• Alignment of cuts with the shear line allows the plug to be rotated
• When an inappropriate key is inserted, pins do not align along the shear line, and the lock does not turn

Tubular Locks

• Typically found on car alarms or vending machines
• Locks have 6-8 pins
• Easy to pick with special tools
• The tool to pick the lock could become a new key.

Attacks - Compromising Locks

• Locks are a cornerstone of physical security for centuries
• Many people rely on them daily to protect people and assets
• The trust most people place in locks may be unwarranted
• Locks can be easily compromised with nondestructive methods
• This can take seconds using readily available tools
• "Locks keep honest people honest"

Lock Picking

• Lock picking was exclusive to locksmiths, professional thieves, spies, and magicians for years
• Information about lock-picking methods and tools has become readily available with the advent of the Internet
• YouTube hosts many lock-picking videos

Legal Notice

• Laws regarding lock picking vary significantly by state
• In most states, purchasing and possessing dedicated lock-picking tools is legal
• Penalties are raised when caught using them in the commission of a crime

Lock Picking in Movies

• Genuine lock picking in movies was prohibited
• Before 1967, the Hays code (Motion Picture Production Code) required censorship of Hollywood movies
• Censorship involved removing detailed depiction of crime must be removed such as lock picking or mixing of chemicals to make explosives

Lockpicking Tools

• Feelers
• Rakes
• Tension tools

Protecting Against Brute-Force Attacks

• The total number of possible locks is calculated as 40 x 87 = 83,886,080
• Not all these are possible. due to difficulties

Pick vs Bypass

• Locks can be opened non-destructively either by picking or bypassing
• Picking is acting on the lock mechanism and simulating the operation of the key
• Bypassing is manipulating the bolt without using the lock

Side Channel Attacks

• Rather than directly bypass security measures, an attacker goes around them
• This is done by exploiting other vulnerabilities not protected by the security mechanisms
• Side channel attacks are often surprisingly simple to perform

Authentication

• Authentication involves determining identity based on a combination of what the person has, knows, and is
• This includes the following:
  • Barcodes
  • Magnetic stripe cards
  • Smart cards
  • RFIDS
  • Biometrics

Barcodes

• Developed in the 20th century to improve efficiency in grocery checkout
• First-generation barcodes represent data as variable-width vertical lines, creating a one-dimensional encoding
• More recent barcodes use two-dimensional patterns readable by specialized optical scanners

Authentication via Barcodes

• Airlines use barcodes on boarding passes for flight check-in and boarding since 2005
• The barcode is encoded as an internal unique identifier to look up passenger's record
• Authentication involves verifying that the boarding pass was purchased in that person's name and a photo ID
• Barcodes provide more convenience than security

Magnetic Stripe Cards

• Plastic cards with a magnetic stripe contain personalized information about the cardholder
• The first track contains the cardholder's full name, account number, format information, and other data
• The second track may contain the account number, expiration date, issuing bank information, track format, and discretionary data

Magnetic Stripe Card Security

• A vulnerability of magnetic stripe cards is easy to read and reproduce
• Attackers can buy magnetic stripe readers at low cost to read data
• Coupled with a magnetic stripe writer, attackers can clone cards easily
• PIN entry is often required for card usage to improve security

Smart Cards

• Smart cards incorporate an integrated circuit, optionally with an on-board microprocessor
• Microprocessors have reading and writing capabilities, which allows data to be accessed and altered
• Smart card technology can provide secure authentication mechanisms that protect the information and are difficult to duplicate

Smart Card Authentication

• Commonly employed by large companies and organizations for strong authentication using cryptography
• May be used as an "electronic wallet" containing funds for various services like parking, transport, and retail transactions.

SIM Cards

• Many mobile phones use a special smart card called a subscriber identity module card (SIM card)
• The SIM card is issued by a network provider
• It maintains personal and contact information for a user
• The user can then authenticate to the cellular network

SIM Card Security

• SIM cards contain several pieces of information that are used to identify the owner and authenticate to the appropriate cell network.
• Each SIM card corresponds to a record in the database of subscribers maintained by the network provider.
• A SIM card features an integrated circuit card ID (ICCID), which is a unique 18-digit number used for hardware identification.
• A SIM card contains a unique international mobile subscriber identity (IMSI), which identifies the owner's country, network, and personal identity.
• SIM cards also contain a 128-bit secret key used for authenticating a phone to a mobile network.
• Many SIM cards require a PIN as an additional security mechanism before allowing any access to information on the card.

RFIDs

• Radio frequency identification (RFID) is a rapidly emerging technology
• It relies on small transponders to transmit identification information via radio waves
• RFID chips feature an integrated circuit for storing information
• A coiled antenna transmits and receive a radio signal.

RFID Technology

• RFID tags must be used in conjunction with a separate reader or writer.
• While some RFID tags require a battery, many are passive and do not.
• The effective range of RFID varies from a few centimeters to several meters
• In most cases, since data is transmitted via radio waves, it is not necessary for a tag to be in the line of sight of the reader

Wide Variety of RFID Applications

• Consumer product tracking
• Car key fobs
• Electronic toll transponders.

Passports

• Modern passports from several countries, including the United States, feature an embedded RFID chip
• RFID chips contain information about the owner, including a digital facial photograph
• Airport officials can use the photograph to compare the passport's owner to the person who is carrying it

Passport Security

• To keep sensitive things private, all RFID communications are encrypted with a secret key
• In a lot of cases, the secret key is simply the passport number, the holder’s birthday, and when it goes out of date
• All this info is either written out or put into codes on the card with barcodes or other optical techniques
• Even though the secret key is meant to be for only people with direct access, an attacker could put together the key because passport numbers are ordered

Biometrics

• Refers to any measure used to uniquely identify a person based on biological or physiological traits.
• Biometric systems incorporate some sort of sensor or scanner to read in biometric information
• This info is compareed to stored templates of accepted users before giving access

Requirements for Biometric Identification

• Universality: Almost every person should have this characteristic
• Distinctiveness: Each person should have noticeable differences in the characteristic
• Permanence: The characteristic should not change significantly over time
• Collectability: The characteristic should have the ability to be effectively determined and quantified

Biometric Indentification

Candidates for Biometric IDs

• Fingerprints
• Retinal/iris scans
• DNA
• "Blue-ink” signature
• Voice recognition
• Face recognition
• Gait recognition identifies people by analyzing their walking patterns
• Universality, distinctiveness, permanence, and collectability should be considered for each

Direct attacks against computers - Environmental attacks

• Electricity: Computing equipment requires a steady, uninterrupted power supply to function
• Temperature: Exceeding the natural operating temperature of computer chips can cause severe damage
• Limited conductance: Electronic equipment relies on limited conductance in its environment; a short circuit can be caused by random parts of a computer that are connected electronically

Direct attacks against computers - Eavesdropping

• Eavesdropping is secretly listening in on another person's conversation.
• Protecting sensitive data goes beyond just computer security, and also encompasses where it is being read and entered
• Eavesdropping techniques
  • Using social engineering to allow the attacker to read information over the victim's shoulder
  • Installing small cameras to capture the information as it is being read
  • Using binoculars to view a victim's monitor through an open window.
• Direct observation techniques are shoulder surfing

Direct attacks against computers - Wiretapping

• Communication networks use inexpensive coaxial copper cables
• These transmit information via electrical impulses
• Inexpensive means is used to measure impulses and reconstruct the data being transferred through a tapped cable
• The attacker can then eavesdrop on network traffic
• This wiretapping is passive because there is no alteration of the signal

Direct attacks against computers - Signal Emissions

• Computer screens emit radio frequencies that are used to detect what is being displayed
• Visible light reflections can also be used to reconstruct a display from its reflection on a wall, coffee mug, or eyeglasses
• Both of these require the attacker to have a receiver close enough to detect the signal

Direct attacks against computers - Acoustic Emissions

• Dmitri Asonov and Rakesh Agrawal published a paper in 2004 on using audio recording of keyboard typing to reconstruct what was typed
• Each keystroke has minute differences in the sound it produces, and certain keys are known to be pressed more often than others
• After training an advanced neural network to recognize individual keys, their software recognized an average 79% of all keystrokes

Direct attacks against computers - Hardware Keyloggers

• A keylogger is any means of recording a victim's keystrokes
• Keyloggers access passwords or other sensitive information
• Hardware keyloggers are small connectors installed between a keyboard and computer
• For example, a USB keylogger is a device containing male and female USB connectors

TEMPEST

• US government code word for limiting info-carrying electromagnetic emanations(flow) TEMPEST establishes three zones of protection:
• An attacker has almost direct contact with the equipment, such as in an adjacent room or within a meter of the device in the same room
• An attacker is less than 20 meters to the equipment or is blocked by a building to have an equivalent amount of attenuation
• An attacker is less than 100 meters to the equipment or is blocked by a building to have an equivalent amount of attenuation

Emission Blockage

• To block visible light, put sensitive equipment in a windowless room
• To block acoustic, put it in a room lined with sound dampening materials
• Make sure every such cord and cable is well grounded and insulated to block electromagnetic emanations

Faraday Cages

• Surrounding sensitive equipment in an area with metallic conductive shielding or mesh
• The holes must be smaller than the wavelengths of the electromagnetic radiation that you with to block from getting in.

Computer Forensics

• A practice of obtaining information contained on electronic mediums, such as computer systems, hard drives, and optical disks
• It is usually for gathering evidence to be used in legal proceedings.
• Advanced techniques are also unfortunately employed by hackers

Computer Forensics Analysis

• Typically involves the physical inspection of the components of a computer, sometimes at a microscopic level
• It can also involve electronic inspection of a computer’s parts as well.

Special-Purpose Machines - ATMs

• An automatic teller machine (ATM) allows customers of financial institutions to complete withdrawal and deposit transactions without human assistance
• Customers insert a magnetic stripe credit or debit card, enter a PIN, and then deposit or withdraw cash from their account
• The ATM encrypts the entered PIN and compares it to an encrypted PIN stored on the card or in a remote database

Special Purpose Machines - Attacks on ATMs

• Lebanese loop: A perpetrator inserts this sleeve into the card slot of an ATM
• When a customer inserts their credit card, it sits in the sleeve
• This is out of sight from the customer, who thinks that the machine has malfunctioned
• After the customer leaves, the perpetrator can then remove the sleeve with the victim's card
• Skimmer: reads and stores magnetic stripe information when a card is swiped
• An attacker can install a skimmer over the card slot of an ATM and store customers' credit information without their knowledge
• Later, duplicates the original cards.
• Fake ATMs: capture both credit/debit cards and PINs at the same time

Peripheral Security

• Risks associated with common peripherals can come from removable media, laptops, shoulder surfing, discarded devices, and printed documents
• To mitigate risks, we need to control access to devices such as printers, copiers, mobile devices, imaging devices, or any other devices that store data and are connected to networks

Threats to physical and environmental security

• Energy, for example, electricity
• Equipment, for example, mechanical or electronic component failure
• Fire and Chemical, for example, explosion, smoke, or industrial pollution
• Human, for example, riot, war, terrorist attack, or bombing
• Natural Disaster, for example, earthquake, volcano, landslide, or tornado
• Pandemic disease, for example, bacteria or virus
• Weather, for example, sandstorm, humidity, flood, or lightning

Environmental Disruption

• Natural disasters and man-made environmental problems are some of the most prevalent threats

Interruptions to Servcie

• Serious business interruption may cause business disaster

Loss of System Integrity

• If intruders are able to gain physical access to hardware components, they may be able to bypass logical access controls
• With this direct access, they can carry out illegal actions on systems and Components

Physical Theft

• Organizational functions may be interrupted if there is no backup or the org doesn't replace stolen components in a timely manner

Unauthorized Disclosure of Information

• Insufficient physical security controls may give intruders to easy access to an organization's information assets

Physical and environmental security

• Best managed using a layered defense approach

The layered defense approaches

• Divided into two broad areas:
• Physical security of premises and offices
• Physical security of equipment

Physical Entry Controls

• Restrict access to information-processing resources by allowing only authorized individuals in the area
• Control the entry and exit of employees, equipment, and media from an area
• Area examples include the following:
  • An office building
  • Data center
  • Areas that contain critical information-processing resources

Access controls for employees and visitors

• Employee access - Restriction of employee access depends on the need for access, job function, and responsibilities
• Positive identification and access control are mandatory and must involve ID badge
• Visitor access - Permit visitor access only to those areas where they have specific and official purposes

Equipment Placement and Protection

• Organizations should secure equipment from environmental threats, hazards, and opportunities for unauthorized access
• Organizational assets face destruction from exposure to fire, smoke, water, and other hazards
• Information and information processing resources should be protected with a diverse set of countermeasures

Protection Cont.

• Fire - install fire sensors, heat sensors, smoke sensors, fire extinguishers or sprinkler systems
• Sprinklers - water-based sprinklers should be dry pipe systems that do not have water in normal conditions
  • In the equipment rooms, avoid water
• Smoke is hazardous to both personnel and equipment
• Smoke may originate from malfunctioning computer systems or electrical fires
• If a system’s requirements demand uninterrupted processing in the event of a prolonged outage, a backup generator should be considered An UPS can be used to support critical business operations to provide enough time for system administrators to shut down systems and equipment
• systems that manage critical information should have air-conditioning units that provide continuous monitoring and recording of temperature and humidity