1. CIT 380: Securing Computer SystemsSlide #1 CIT 380: Securing Computer Systems Physical Security

2. CIT 380: Securing Computer SystemsSlide #2 Physical Security 1.Physical Security Plan 2.Elements of Physical Security 3.Environmental Threats 4.Physical Access 5.Theft 6.Backups 7.Printouts 8.Unattended Terminals

3. CIT 380: Securing Computer SystemsSlide #3 Physical Security Plan List of physical assets to be protected –Descriptions –Replacement cost (hardware + data) Locations of physical assets Description of security perimeter(s) –Holes in perimeter (doors, windows, etc.) –Multiple perimeter example: Outermost: campus Outer: building Inner: server room Threats that you’re protecting against Security defenses

4. CIT 380: Securing Computer SystemsSlide #4 Elements of Physical Security 1.Determent –Convince people not to attack. 2.Detection –Alarms, guards, and other means of detecting attacks. 3.Delay –Elements that slow down an attacker, e.g. locks & safes. 4.Response –Guards or a call to the police.

5. CIT 380: Securing Computer SystemsSlide #5 Environmental Threats: Fire Dangers: –Flames –Heat –Smoke –Water Defenses –Gas-charged extinguishers –Dry-pipe water sprinkler systems

6. CIT 380: Securing Computer SystemsSlide #6 Environmental Threats: Temperature Most computer systems need 50-90F Dangers: –Cold: thermal shock on power-on, cracking ICs/boards. –Hot: unreliability, then system failures as heat increases. Defenses –Air-conditioning system –Good air circulation –Temperature alarm system

7. CIT 380: Securing Computer SystemsSlide #7 Environmental Threats: Water Humidity –Below 20% static discharge becomes a problem. –Must remain below dew point to avoid condensation on chilled surfaces. –Defenses: Humidifier/de-humidifier Humidity alarm Water –Defenses: Keep drinks away from computers. Alarm at low level of flooding. Automatic power shut-off at higher level.

8. CIT 380: Securing Computer SystemsSlide #8 Environmental Threats: Electrical Electrical Noise –Motors, fans, even vacuum cleaners can generate electrical surges. –Defenses: UPS with power line filter Anti-static mats Lightning –Defenses Turn off computer systems during lightning storms. Surge suppressors may help for distant strikes.

9. CIT 380: Securing Computer SystemsSlide #9 Environmental Threats Dust –Collects on drive heads and degrades media by abrasion. –Dust is slightly conductive and can cause circuit boards to short and fail if much accumulates. –Defenses: Air Filtering Systems Vacuuming Vibration –Can work circuit boards out of sockets and drive heads out of alignment over time. –Defenses: Rubber or foam mat.

10. CIT 380: Securing Computer SystemsSlide #10 Physical Access Raised floors/dropped ceilings –If internal walls do not extend above dropped ceilings and below raised floors, computer room door security can be easily bypassed. Air ducts –Serve computer room with many small air ducts. –Weld screens over air vents or within air ducts. –Motion detectors. Glass walls –Easy to break—avoid them.

11. CIT 380: Securing Computer SystemsSlide #11 Network Cabling Threats –Wiretapping/monitoring –Cutting –Connecting to AC power Defenses –Run through steel conduits, not open trays. –Double-walled conduits with pressurized gas between layers; alarm if pressure falls.

12. CIT 380: Securing Computer SystemsSlide #12 Alarms Sensor types –Vibration detectors –Video cameras –Motion sensors –Infrared (body heat) detectors False alarms –Causes Weather (thunder, lightning, wind) Created by attacker –Degrade response guards/police will ignore alarms if too many false.

13. CIT 380: Securing Computer SystemsSlide #13 Theft Reasons: –Resale –Access to stored information Targets –Laptops –Components: RAM, CPUs, hard disks –PCs/servers

14. CIT 380: Securing Computer SystemsSlide #14 Theft Defenses Limit physical access. –Keep critical systems in high security areas. Case locks to prevent access to components. Laptop locks to lock laptop to desk. Visible equipment tags with serial numbers. Phone-home software for tracing. Encryption of information.

15. CIT 380: Securing Computer SystemsSlide #15 Backups Protect availability of information. Offer potential for confidentiality violation.

16. Backups Defenses: –Secure in safe after creation. –Periodically move to secure offsite storage. –Verify that you can restore data from backups. Verify old backups periodically too. –Encrypt data on backup tapes. –Bulk erase tapes to destroy data before disposal. CIT 380: Securing Computer SystemsSlide #16

17. CIT 380: Securing Computer SystemsSlide #17 Printouts Provide availability when computers down. Potential for confidentiality violation. –Dumpster diving Defenses –Separate wastebaskets for confidential/unclassified information. –Paper shredding Expensive shredding recovery services exist.

18. CIT 380: Securing Computer SystemsSlide #18 Unattended Terminals Offer anonymous attacker access Defenses: –Auto-logout shells or daemons –Automatic screen locking –Boot only from hard disk –BIOS password to protect boot settings –Case lock to prevent battery removal or BIOS chip replacement

19. CIT 380: Securing Computer SystemsSlide #19 Key Points Physical security is an essential component of computer security. –Many systems are more vulnerable to physical threats than system/network attacks. Elements of Physical Security –Determent –Detection –Delay –Response Backups are a defense against many threats, but must be defended themselves.