Physical Security
CSC 481/681
Principles of Computer Security
Reference: Goodrich and Tamassia: Sections 2.1-2.5
Where we are and where we’re going...
This class meeting:
Next time
Other things to be working on:
CSC 481/681
Principles of Computer Security
Physical Security
Physical Security
Attack Model
Many security measures can be bypassed with physical access
Threat Model
What does the adversary know?
What can the adversary access?
What can the adversary do?
How does physical access affect attacker’s abilities?
Who needs access?
(Principle of Least Privilege)
CSC 481/681
Principles of Computer Security
Physical Security
Physical Security�Some Assets to Consider
CSC 481/681
Principles of Computer Security
Physical Security
User Authentication
How to determine if access should be granted
Whether electronic or physical access, authorize access!
Three basic types of authentication:
Multi-factor authentication combines multiple techniques
CSC 481/681
Principles of Computer Security
Physical Security
Common access controls
What principle does each of the following use?
Keyed locks are...
Combination locks are…
Cards with magnetic stripes are…
Cards that require a PIN are…
Fingerprint scanners on computers/phones are…
CSC 481/681
Principles of Computer Security
Physical Security
Common access controls
What principle does each of the following use?
Keyed locks are...
something you have
Combination locks are…
something you know
Cards with magnetic stripes are…
something you have
Cards that require a PIN are…
something you have and something you know (2FA)
Fingerprint scanners on computers/phones are…
something you are
CSC 481/681
Principles of Computer Security
Physical Security
Something You Have
Keyed locks, card access, fobs, RFID, door openers, ...
Keyed Locks
Card Access
Garage door and car openers
CSC 481/681
Principles of Computer Security
Physical Security
Something You Know
Combination locks, keypads, PINs, ...
Benefits
Drawbacks
So: Best used with other methods (2FA)
CSC 481/681
Principles of Computer Security
Physical Security
Something You Know
About passwords…
People pick bad passwords if they are allowed to
CSC 481/681
Principles of Computer Security
Physical Security
Something You Know
Warning about “alternative access methods”
But even strong passwords don’t work if easy alternative method...
CSC 481/681
Principles of Computer Security
Physical Security
Something You Are
Biometrics
Fingerprint scanner
Facial Recognition
Retinal scanner
Desired properties:
Some issues:
CSC 481/681
Principles of Computer Security
Physical Security
New Issues
Internet of Things (IoT)
Connecting physical controllers or actuators to the Internet means hacks can have physical consequences.
IoT Devices
CSC 481/681
Principles of Computer Security
Physical Security
Physical Area Security�Controlling Access
Common physical access controls
Things to remember
CSC 481/681
Principles of Computer Security
Physical Security
Physical Security for Storage Devices
Efficient space management can leave security vulnerabilities...
CSC 481/681
Principles of Computer Security
Physical Security
What happens when you delete a file?
(and really delete - not just move to trash can!)
Typical filesystem - Uh Oh! Better delete extortion.doc!
CSC 481/681
Principles of Computer Security
Physical Security
What happens when you delete a file?
(and really delete - not just move to trash can!)
What really happened? Removed name and shifted data blocks to the free list.
CSC 481/681
Principles of Computer Security
Physical Security
More on Physical Storage Media
CSC 481/681
Principles of Computer Security
Physical Security
Data Clearing Example
DoD Guidelines
From the DoD National Industrial Security Program Operations Manual (“NISPOM” or DoD Publication 5220.22-M)
Terminology:
“Clear”: Before reuse in similar environment
“Sanitize”: When removed from that env
Tape type: Amount of energy required to change magnetization - Type III is best for long-term storage (very stable), but makes it harder to sanitize.
CSC 481/681
Principles of Computer Security
Physical Security
Protections
Drive Encryption
Styles of encryption:
Where does the key come from?
From 2019 IEEE Symposium on Security and Privacy:
CSC 481/681
Principles of Computer Security
Physical Security
Protections
Drive Encryption
Styles of encryption:
Where does the key come from?
Remember
Often “easier” vulnerabilities than breaking the crypto
CSC 481/681
Principles of Computer Security
Physical Security
Physical Security for Networks
Physical network connections:
Protections:
Fiber is harder to tap than copper, but still possible!
CSC 481/681
Principles of Computer Security
Physical Security
Threats from Physical Proximity
“Emanation Security” (EMSEC)
Optical emanations
Audio emanations
Electromagnetic emanations
Protections: Solid walls; Sound buffering (or masking); Faraday cages
CSC 481/681
Principles of Computer Security
Physical Security
Summary
Always ask: “What can the attacker access”?
Does physical access give advantages?
Especially important in design of secure facilities.
CSC 481/681
Principles of Computer Security
Physical Security