Physical Barriers. Physical Security. Mantraps. Mantrap. Week 6 Part 1. A chain is only as strong as its weakest link

Transcription

1 Physical Security Physical Barriers Week 6 Part 1 A chain is only as strong as its weakest link Physical Barriers Mantraps Naturally, physical barriers must be in place to prevent physical access to a restricted area Some barriers restrict all access (a wall) Some require authentication Many high security areas use a special room called a mantrap It separates a secure area from a nonsecured area There are only two interlocking doors each door has a different code only one person may be in the room at a time 6/29/2018 CSC Cook - Sacramento State - Summer /29/2018 CSC Cook - Sacramento State - Summer Mantraps Mantrap Attacker may get past the first door but get trapped in the second exit code is different from the entrance code they are stuck and doomed! 6/29/2018 CSC Cook - Sacramento State - Summer /29/2018 CSC Cook - Sacramento State - Summer

2 Other Devices Some Fencing Deterrents Video surveillance closed-circuit television (CCTV) cameras transmit signal to limited set of receivers cameras may be fixed or able to move passive deterrent Fencing barrier around secured area 8 topped with barbed wire slanted at 45% angle modern perimeter fences are equipped with other deterrents Technology Anti-climb paint Anti-climb collar Roller barrier Rotating spikes What is Does Nontoxic petroleum gel-based paint that is thickly applied. Doesn't not harden. Used on poles, pipes, wall tops, and railing above head height. Spiked collar put at the top of a pole. Can be used to keep attackers away from cameras. Non aggressive. Top of wall contains a long rod that can spin. Prevents attacker from getting a grip. Spiked rings at the top a fence or wall. Not possible to throw a rug over like barbed wire. 6/29/2018 CSC Cook - Sacramento State - Summer /29/2018 CSC Cook - Sacramento State - Summer Roller Barrier Rotating Spikes 6/29/2018 CSC Cook - Sacramento State - Summer /29/2018 CSC Cook - Sacramento State - Summer Tailgating Methods of Tailgating Tailgating is the act of following behind an authorized person through an access door Shoulder surfing is the act of casually looking at someone entering a keypad code Tailgater calls please hold the door Waits outside a door and enters when an employee leaves Employee conspires with unauthorized person to walk together through open door 6/29/2018 CSC Cook - Sacramento State - Summer /29/2018 CSC Cook - Sacramento State - Summer

3 Authentication Authentication Protecting the Cyber-Key Whether it is to get through an access door or log into a computer, a person must be authenticated Users must provide credentials some proof that the person the "real" user rather than an attacker 6/29/2018 CSC Cook - Sacramento State - Summer Authentication Types of Authentication Credentials There are various approaches to authentication Organizations will use at least one, but others will use multiple systems depending on the value of the asset 1. What you know user has special knowledge e.g. safe combination 2. What you have the user has an physical device e.g. keycard to open a door 3. What you are attribute of the user that is unique e.g. face recognized by guard 6/29/2018 CSC Cook - Sacramento State - Summer /29/2018 CSC Cook - Sacramento State - Summer What You Know What You Know Knowledge of the User is the Key The most common way to authenticate users is to give them special, private, information Logging into a system consists of revealing that data to the computer software 6/29/2018 CSC Cook - Sacramento State - Summer

4 What You Know: Passwords Cipher Locks When a user logs in asked to identify themself enters username asked to authenticate enters password Passwords provide only weak protection More sophisticated alternative to a key lock Combination sequence necessary to open door Can be programmed to accept an individual s code at only certain days or times 6/29/2018 CSC Cook - Sacramento State - Summer /29/2018 CSC Cook - Sacramento State - Summer Cipher Locks Cipher Lock Also can records when door is opened and by which code Although vulnerable to shoulder surfing some units will rearrange the numbers using LED digits Often used in conjunction with tailgate sensor 6/29/2018 CSC Cook - Sacramento State - Summer /29/2018 CSC Cook - Sacramento State - Summer Have You Have What You Have Knowledge of the User is the Key Another form of authentication is to require the user to process a physical item This is commonly used for physical access to buildings such as keys, RFID badges, etc 6/29/2018 CSC Cook - Sacramento State - Summer

5 Keyed Locks Keyed Locks Hardware locks are a standard security system This provides minimal security, but very lost cost and convenient Deadbolts can add to security Keyed locks requires a physical key to open the lock security can be compromised if keys lost, stolen, or duplicated attackers can use lock picking to circumvent security 6/29/2018 CSC Cook - Sacramento State - Summer /29/2018 CSC Cook - Sacramento State - Summer Residential & Deadbolt Locks Key Management Procedures Inspect locks regularly Issue keys only to authorized users Keep records of who uses and turns in keys Keep track of issued keys 6/29/2018 CSC Cook - Sacramento State - Summer /29/2018 CSC Cook - Sacramento State - Summer Key Management Procedures Physical Token Locks Master keys should not have identifying marks Secure all unused keys put in a locked safe it should be monitored by camera or security Mark duplicate master keys with Do not duplicate A physical token is another alternative access method Like a cipher lock, physical token locks interact with a computer 6/29/2018 CSC Cook - Sacramento State - Summer /29/2018 CSC Cook - Sacramento State - Summer

6 Physical Token Advantages Type of Token: Cards Advantages over passwords token code changes frequently attacker has to crack code within time limit if token is stolen, it becomes obvious Token system variations some systems use token code only others use code in conjunction with password some combine PIN with token code Smart card contains integrated circuit chip that holds information contact pad allows access to chip contents contactless cards require no physical access Common access card (CAC) bar code, magnetic strip, and bearer s picture issued by US Department of Defense 6/29/2018 CSC Cook - Sacramento State - Summer /29/2018 CSC Cook - Sacramento State - Summer Type of Token: RFID Radio frequency identification (RFID) tags are common, reliable alternative to keys Key features: read by a proximity reader can be affixed inside ID badge badge can remain in bearer s pocket 6/29/2018 CSC Cook - Sacramento State - Summer /29/2018 CSC Cook - Sacramento State - Summer RFID Strip How RFID works 1. Badge is created with a unique code (and the owner's photo) 2. Radio waves hit the badge which emits a signal identifying the owner 3. Proximity reader receives signal and activates the lock release 6/29/2018 CSC Cook - Sacramento State - Summer /29/2018 CSC Cook - Sacramento State - Summer

7 RFID Can Track Type of Token: Disconnected Code Maintain a list of who have permission to enter Record time they entered & left Log any access attempts (did someone with low access try to open the door?) Besides the RFID versions, there are disconnected code tokens small devices with a window display synched with an authentication server code is generated from an algorithm code changes every 30 to 60 seconds 6/29/2018 CSC Cook - Sacramento State - Summer /29/2018 CSC Cook - Sacramento State - Summer Disconnected Code Tokens Disconnected Code Tokens Token login steps user enters username and code from token authentication server looks up algorithm associated with that user generates its own code compares it to the entered code if a match, user is authenticated 6/29/2018 CSC Cook - Sacramento State - Summer /29/2018 CSC Cook - Sacramento State - Summer What You Are The User Is the Key What You Are The third form of identification is characteristics about the user that makes them unique Physical credentials and passwords can be stolen But, this is difficult for an attacker to fake or steal 6/29/2018 CSC Cook - Sacramento State - Summer

8 Biometrics Fingerprint Scanners Standard biometrics uses person s unique physical characteristics for authentication Examples: fingerprint scanners (most common type) face hand eye characteristics Static fingerprint scanner takes picture and compares with image on file common on doors and panels Dynamic fingerprint scanner uses small slit or opening common on laptop computers 6/29/2018 CSC Cook - Sacramento State - Summer /29/2018 CSC Cook - Sacramento State - Summer Dynamic Fingerprint Scanner Disadvantages of Standard Biometrics Cost of hardware scanning devices Readers have some amount of error reject authorized users false positive accept unauthorized users false negative is it better to fail-safe or fail-open? Privacy Concerns 6/29/2018 CSC Cook - Sacramento State - Summer /29/2018 CSC Cook - Sacramento State - Summer Behavior Biometrics Behavior Biometrics: Keystroke Behavioral biometrics authenticates by normal actions the user performs Examples: keystroke dynamics voice recognition computer footprinting Keystroke dynamics attempts to recognize user s typing rhythm All users type at a different pace Provides up to 98 percent accuracy Uses two unique typing measurements dwell time it takes to press and release a key flight time between keystrokes 6/29/2018 CSC Cook - Sacramento State - Summer /29/2018 CSC Cook - Sacramento State - Summer

9 Voice Recognition Several characteristics make each person s voice unique Voice template can be created Phonetic cadence of putting words together is part of real speech pattern Difficult for an attacker to authenticate using a recording of user s voice 6/29/2018 CSC Cook - Sacramento State - Summer Computer Footprinting Cognitive Biometrics Relies on typical access patterns Geographic location Time of day Internet service provider Basic PC configuration Cognitive biometrics relates to perception, thought process, and understanding of the user Easier for user to remember because it is based on user s life experiences Difficult for an attacker to imitate 6/29/2018 CSC Cook - Sacramento State - Summer /29/2018 CSC Cook - Sacramento State - Summer Cognitive Biometrics Example identifying specific faces user selects memorable lifetime events and is asked for details about them Predicted to become a key element of authentication in the future Hardware Security Stop Theft by Locking It Down! 6/29/2018 CSC Cook - Sacramento State - Summer

10 Securing Devices Hardware Security It is important to prevent unauthorized users from gaining physical access to equipment Aspects of securing devices physical access security host hardware security mobile device security Hardware security is the act of physically securing host system hardware Some equipment is expensive and may contain important data Theft of a device can result in massive financial damage 6/29/2018 CSC Cook - Sacramento State - Summer /29/2018 CSC Cook - Sacramento State - Summer Hardware Security Cable Lock Portable devices often have steel bracket security slot Cable lock is inserted into slot and secured to device The cable is connected to lock secured to desk or immobile object 6/29/2018 CSC Cook - Sacramento State - Summer /29/2018 CSC Cook - Sacramento State - Summer Locking Up Devices Mobile Security Laptops may be placed in a locked safe Locking cabinets can be prewired for power and network connections allow devices to charge while stored Mobile device security many security provisions that apply to laptops apply to mobile devices since they are basically the same Mobile devices unique security features remote wipe / sanitation data can be erased if device is stolen GPS tracking - can pinpoint within 100 yards 6/29/2018 CSC Cook - Sacramento State - Summer /29/2018 CSC Cook - Sacramento State - Summer

11 Dumpster Diving Dumpster Diving Low tech and very effective Dumpster diving is the act of digging through trash to find useful information Business often discard items they do not think have value But it can provide: inside knowledge needed for social engineering knowledge for network attacks 6/29/2018 CSC Cook - Sacramento State - Summer Valuable Dumpster Items Valuable Dumpster Items Calendars can reveal employees are out of town at a particular time wall calendars can have info about birthdays, events, etc Phone directories gives attackers a list of names and how to contact them great for impersonations Old hardware old USB flash and hard drives contain massive amount of data all old computers must have hard drives removed and destroyed System Manuals shows the systems being used attackers can concentrate on know vulnerabilities 6/29/2018 CSC Cook - Sacramento State - Summer /29/2018 CSC Cook - Sacramento State - Summer Valuable Dumpster Items Valuable Dumpster Items Policy manuals can reveal true level of security show where weak points are Memos seemingly unimportant memos can often provide small bits of useful data attackers use this to perfect impersonations Organization charts can identify who in the organization have authority shows who can impersonate and who to trick 6/29/2018 CSC Cook - Sacramento State - Summer /29/2018 CSC Cook - Sacramento State - Summer

12 A True Example A True Example 1. One attacker gather preliminary data dumpster dived for some basic info called human resources asked for and got names of key employees 2. Group of attackers using these names approached door to building pretended to have lost key code let in by friendly employee entered another secured area in the same way 3. Group entered the CFO s office group had learned CFO was out of town because of his voic greeting message 4. Gathered information from unprotected computer 5. Dug through trash to retrieve useful documents 6/29/2018 CSC Cook - Sacramento State - Summer /29/2018 CSC Cook - Sacramento State - Summer A True Example 6. One attacker called the help desk from CFO s office pretended to be CFO urgently asked for password help desk gave password 7. Attackers then left building with complete network access and company files USB Thumb Drives Thumbs Down to Malware 6/29/2018 CSC Cook - Sacramento State - Summer USB Thumb Drives Viruses in USB Thumb Drives In the past, viruses used to be spread using floppy diskettes This technology is obsolete - replaced by USB thumb drives Sadly, USB technology makes it even easier to spread viruses than ever before Files (usually.exe) on thumb drives, can be infected just like on normal hard drives However, USB drives can be autorunned when inserted, the operating system looks for a hidden file called "autorun.inf" this is a text file which tell which files should be executed immediately this is why your installation CDs startup automatically! 6/29/2018 CSC Cook - Sacramento State - Summer /29/2018 CSC Cook - Sacramento State - Summer

13 Viruses in USB Thumb Drives Example autorun.inf contents A virus can "hitchhike" on the USB drive How it works: virus installs as the "autorun" software the actual virus will be a.exe file (and usually hidden somewhere on the thumb drive just by inserting an infected thumb drive, the virus executes and spreads [autorun] open=setup.exe icon=setup.exe,0 label=software Installation Mode=Administrator 6/29/2018 CSC Cook - Sacramento State - Summer /29/2018 CSC Cook - Sacramento State - Summer Human Engineering and USB Human Engineering and USB Attackers can leave an infected USB thumb drive outside a company of government office Often this is placed in a nearby business a bench or table outside the building near a communal area like the smoker's area An employee finds the thumb drive and wants to help the person that "lost" it takes it into the building past the security to their computer they put it in, and the virus spreads As a result, most institutions do not permit USB drives 6/29/2018 CSC Cook - Sacramento State - Summer /29/2018 CSC Cook - Sacramento State - Summer Protecting Your Computer Fortunately Protecting your computer Microsoft created a page that guides you through disabling autorun URL: Protecting your thumb drive to protect the thumb drive, create a "autorun.inf" file that cannot be changed by a virus an easy way is to create an "autorun.inf" folder! Microsoft decided to disable autorun on USB drives with a February 2011 update CD/DVD/Blueray still function the same they are read-only (for the most part) viruses can still infect from these but they have to be infected when burned 6/29/2018 CSC Cook - Sacramento State - Summer /29/2018 CSC Cook - Sacramento State - Summer