The protection of personnel, hardware, programs, networks, and data from physical circumstances and events.

learn more… | top users | synonyms (1)

2
votes
1answer
32 views

Defense in depth vs single security architecture

Traditionally, we have been that defense in depth is the best practice approach if we want to secure our premises from security breach. However, I recently read about DoD's Joint information ...
0
votes
1answer
22 views

A cctv system for a small shop

I am not sure if I should ask here but I really can't find any information anywhere else. A family member of mine (let's say X) runs a small fashion shop in Hong Kong, China. The problem is that ...
4
votes
5answers
289 views

Do I need to secure a computer from physical attacks when attackers can already harm in many other ways?

Recently, I was working on a computer system for a model railroad club. This computer system is capable of monitoring and controlling the positions of all the (physical) trains which could be ...
2
votes
3answers
83 views

What are the security implications of a dead laptop?

My laptop recently died. I've got a replacement, and I've already pulled both hard drives out of the old one and ensured that there's no disc in the DVD drive. As far as I know, that should ...
0
votes
2answers
86 views

Is there a cryptographic function that generates a reconizable visual pattern?

I have to build a system that will ultimately print a pass allowing access to a building. The validation of this ticket will be done manually (it can also be automatic but that's not likely at this ...
23
votes
2answers
3k views

How do Travel Sentry locks work? (supposedly openable only by security agencies)

Apparently Travel Sentry locks can only be opened: by their owner, by the TSA, CATSA and "other security agencies". How do they work technically? Is there some electronics embedded with ...
-1
votes
5answers
92 views

Security software to shutdown PC unless specific approach? [closed]

For future refence: In light of answers and critique, my question should have been: 1. How does one make sure a physical attacker with access to a powered, but locked FDE PC fails his/hers attempt to ...
2
votes
1answer
71 views

How can someone sniff dial-up connection using phone line?

Let's assume we have a computer that sends packets to the internet using dial-up connection, and we have access to the analog data on the phone line(we have access to the phone line), how can we make ...
4
votes
1answer
60 views

Should I wipe a brand new Machine and HDD ?

So I am buying a brand new machine and a HDD separate, when I buy this new HDD should I wipe it before I install it ? What necessary steps should I take to make sure it's pretty much clean of any ...
6
votes
3answers
278 views

Risk of spyware on seized devices

This question (Prevention measures against laptop seizure at US borders) addresses a number of techniques for securing data while crossing borders. Perhaps the most useful advice was to simply not ...
0
votes
2answers
43 views

Can I add a new user to an unencrypted Windows installation from a Windows installation disk?

I recall hearing this before, the ability to boot up a Windows PC with an unencrypted hard drive using an installation disk/usb, and use the command line utility on the Windows installation disk to ...
12
votes
3answers
1k views

In what cases can overly strict security policies be detrimental to organisations?

In a philosophical sense is heterogeneous security, a system where people are given more autonomy, better than security policies/procedures written in stone? I've worked at some companies where ...
1
vote
2answers
17 views

Destroying sensitive partition

I've got multiple partitions on a computer, one for basic, day to day user stuff, and one for pentesting and security. The pentesting partition is encrypted. Could anyone give me, and everyone else, a ...
6
votes
2answers
59 views

How to handle decomissioned/donated/RMAed printers?

Printers, nowadays, almost always include some form of non-volatile storage that keep tracks of pretty much everything that went through the device. In the case of larger, "departmental" system that ...
1
vote
0answers
78 views

Information Security classification [closed]

I've been interested in IT security for a bit (~1 year) and had a bit of experience with NSM as well as web security. I want to have an overview of the entire industry, with all relevant niches and ...
3
votes
2answers
142 views

Disable USB keyboard pluggability on MacBook

I'm concerned about USB devices being physically attached to my MacBook laptop when I am about to unlock my computer or while my computer is unlocked. My threat model involves an attacker who is ...
1
vote
0answers
72 views

Vetting new IT development staff [closed]

In the realm of software development what would be the best way to vet prospective employees? We handle potentially sensitive information, and a code base which could be potentially lucrative to ...
0
votes
1answer
45 views

Ensuring security of a Disaster Recovery Plan

The Disaster Recovery Plan (DRP) is a document that outlines, in detail, the actions that should be taken to restore systems & files in the event of a catastrophe. The fact that these plans hold ...
1
vote
3answers
108 views

How do I protect security camera footage from an adversary?

I am interested in installing a security camera in my car, but I am worried about an adversary gaining physical access to the camera, and destroying the footage; leaving me with no evidence. ...
0
votes
2answers
236 views

Prevent hacking with known IP address and router information on Ubuntu 14.04 LTS [closed]

I’ve had it! It is the second time that a “hacker” (A hacker or should I say thief) has had access to my Ubuntu 14.04 LTS system. The person that I suspect has had physical access to my pc because he ...
0
votes
0answers
24 views

Synchronizing secret codes on two different devices? [duplicate]

I was reading an article about how keyless entry systems for automobiles prevent people from recoding the signal and replaying it to open someone's car. In the article they describe the process as ...
-1
votes
2answers
128 views

High Level NSA Target, Help/Feasibility [closed]

I would like to know the feasibility of certain kinds of attacks. To be clear, assume the target is a high-level priority of the NSA. Is an OS such as tails useless against root-kits/keyloggers, ...
6
votes
3answers
236 views

Any way to prove that two devices are in the same physical space, for authentication?

I need to come up with digital proof that two physical devices are in the same (approximate) location whenever that transaction occurs. This could be: A digital ID and the authenticator A consumer ...
8
votes
5answers
1k views

What Man-made Physical Threat Could Pose Severe Danger to a Server Farm?

I am writing a novel in which a researcher attempts to work against a study he is a part of by purposely sabotaging operations on the research compound. I am wondering if the following is plausible. ...
3
votes
3answers
118 views

How can I prevent someone from carrying out a file from a machine

Assume the following scenario: You have to set up a machine in a way that a user is unable to bring out a certain set of files (or a single file only) from that machine while he has to be able to ...
2
votes
0answers
29 views

How do I start securing a virtual appliance to avoid manipulation? [closed]

We have created an amateur software product related with monitoring and management of specific services. It has been made in Python and runs a web service as frontend to show the data in a nice way ...
1
vote
1answer
42 views

Securing sesitive data from developers

I have an enterprise application running that uses both MySQL and Mongodb datastores. My development team all have ssh access to the machine in order to perform application releases, maintenance etc. ...
3
votes
3answers
184 views

Risk when attacker has only physical access to a computer's USB port

Attacker has only access to USB port and can either attach a device or pen-drive to a computer, that can be on or off. Imagine a scenario where non-reliable people have access to offices, either ...
71
votes
6answers
10k views

Can a lock picker slowly undermine the security of a deadbolt door?

I have a space for computers secured with a simple deadbolt. Someone keeps coming to pick the lock. While working there, I have scared them away three times. There are cameras, but not in useful ...
-2
votes
2answers
84 views

Can I ever hope to be secure using a cell phone or any mobile device? [closed]

I love my phone, it's small, I can bring it everywhere, I can access the wealth of human knowledge online, and do so much more. But with the recent light of the NSA and other world government ...
0
votes
2answers
147 views

How would you set up a ‘cold’ netbook for master-key signing, large Bitcoin transactions, etc? [closed]

I've just ordered a cheap-o netbook on Amazon, with the intention of installing a Linux distro, and turning it into a permanently-offline high-security machine for sensitive tasks. However, I'm no ...
12
votes
6answers
4k views

Does the US government protect its physical internet lines in the US?

It seems like there are lots of ways to prevent man in the middle attacks. I've read many on here and on the rest of the internet. According to wiki you need a secure channel as well to completely ...
1
vote
1answer
368 views

Could a hardware keylogger be detected through measuring USB micro voltage?

All in all, hardware keyloggers are harder to detect. But if computers can measure the exact voltage consumption of their peripherals, could a hardware keylogger be detected by comparing the normal ...
2
votes
1answer
250 views

From how far away can passive RFID tags be read?

I have been told in the past that with specialized equipment, passive RFID tags could be read at 1100 feet. This seemed a bit far fetched to me, and sure enough, a quick Google search turned up ...
4
votes
2answers
120 views

Could Google Mail or Google Drive work as a path to a company's network?

I am a newbie to data security and would like to ask few questions related to Google Mail and Google Drive. What I want to know is how these two apps could be used to access a company's network AND ...
0
votes
1answer
167 views

Is it a security threat to have food or drink next to computers [closed]

I have never worked in big organization and I wonder if any of them considers food or drinks a security threat. More than one movie showed the scenario of an operator who accidentally spills tea on ...
1
vote
0answers
73 views

Protecting data on a remote device

Background I have am developing a service which consists in a small headless client device (e.g. OLinuXino) which will contain sensitive data. The device will be plugged to a remote network (maybe ...
1
vote
1answer
118 views

Is there is a reason for data-cables shredding?

Just to make sure, is there is a reason for shredding any type of data cables? Is it OK to throw them away just as they are? Thanks.
2
votes
1answer
105 views

Can Polygraphs be effectively 'beaten'? [closed]

This article suggests that polygraphs are rather rudimentary and thus very susceptible to being 'beaten'. In pop culture we see all the time movies where polygraphs are beaten -but with great ...
0
votes
3answers
91 views

Locating a stolen device

Yesterday my friends Samsung Galaxy S3 was stolen. We have found the perpetrator but cannot yet prove anything. He is uploading photos to social media via the phone. Is there any chance to download ...
13
votes
5answers
2k views

How to protect source code locally when traveling with it [duplicate]

I will be traveling abroad for several weeks on a business trip as a consultant. I will carry a laptop with an IDE and all the necessary source code so I can make changes on site (which is the ...
0
votes
1answer
79 views

Authentication of temporary worker without a badge (physical security) [closed]

In our company we have a procedure to verify internal worker but we cannot use it for temporary worker. We cannot use badges and because of privacy reasons we cannot use any photos. Is there any other ...
0
votes
1answer
152 views

Are all OSes vulnerable to local password reset attacks

It's not that difficult to reset the password of the administrator account in MSWindows when you have local physical access to the machine Same thing applies on any Linux distro, it's possible to ...
0
votes
3answers
3k views

Is there any virus that can cause physical damage [duplicate]

Like damaging a chip on the motherboard, increase the fan's speed till something explodes or anything similar to that. I am not an IT guru but I never came across a malicious code that couldn't be ...
2
votes
9answers
1k views

How to secure a public device against abuse? [closed]

What I mean by public device? E.g. in Germany we have small stations to charge cars powered by electricity. This stations are small towers with a flap. Behind the flap are plugs to connect the tower ...
4
votes
2answers
2k views

How many unique house keys can possibly exist?

A Yahoo! answers user suggested that there are 5^5 possible unique configurations for a physical key, but the answer wasn't sourced. I wondered if anyone had similar numbers for how many possible key ...
0
votes
1answer
85 views

Storing data permanently vs temporarily

My lecturer said that since hard disk space is so cheap these days, most organisations do not delete the data on the disk. Rather, they only logically delete it (remove the link to the data). If this ...
1
vote
2answers
1k views

Best practices for notebook anti-theft. Computer tracking

I am buying a new Thinkpad with an in-built GPS/Cellular modem. I am thinking what are the best practices for making the notebook secure in case of theft. I am planning to do full disk encryption and ...
1
vote
1answer
512 views

Physical vs Logical - Location/Address

According to the CJIS Security Policy - Access Enforcement The information system shall enforce assigned authorizations for controlling access to the system and contained information. The ...
9
votes
1answer
230 views

Physical security - responsible disclosure

I recently discovered a way to bypass a commonly used security seal system, requiring no special equipment and taking only a matter of seconds. I feel obliged to disclose this, so as to avoid the ...