The protection of personnel, hardware, programs, networks, and data from physical circumstances and events.

learn more… | top users | synonyms (1)

7
votes
2answers
248 views

Building's server room is unlocked: What danger is my building in?

In one of the buildings I work in, there are lawyers and accountants, web developers and marketers, and numerous other small businesses. Everyone's (shared) internet is routed through the same server ...
1
vote
1answer
89 views

Is there a value in using portable programs on a USB key?

If I am working writing a text document in a text editor (say notepad or MS word, or ...) then I can save the file and the encrypt this file. I can then try to erase the original file by overwriting ...
2
votes
8answers
657 views

Finding Hidden Keylogger Through Forcing a Computation Error

It must be possible to detect keylogging by close scrutiny of timing between physical keystroke execution and the character's eventual occurrence on the screen. I've had a friend show me this with ...
3
votes
1answer
81 views

What can be done to prevent disruption of hardware in the event of a powerful solar flare?

I'm under the impression that a sufficiently powerful solar flare can temporarily disrupt and even damage electronics. Are there any practical approaches that one could take to minimize this ...
3
votes
3answers
627 views

Finding hidden cameras

Let's say Alice, Bob, and Mallory all live together in a house. Mallory decides to go on vacation, but before leaving, she decides to play a game with Bob and Alice. She makes two claims: She has ...
1
vote
1answer
257 views

valid PDF signature without using hardware HSM or usb Token

I have a DMS system(alfresco) that needs to sign approx 50.000 valid signatures a year. The signing certificate needs to be acquired from one of the affiliated sub-CA's. So according to the Adobe CDS ...
35
votes
11answers
5k views

Is it possible to turn a computer into a bomb?

I know this newspaper article sounds absurd. Even if a machine is compromised we (should) have hardware safe guards in all our devices to prevent the software from damaging the hardware. But is it ...
1
vote
1answer
98 views

Protecting data on an embedded device

I am to release a system-on-chip device that, during its lifetime, will come to store sensitive data. I want to make that data hard to extract or duplicate. Encrypting is good for dealing with MiTM, ...
3
votes
1answer
288 views

How hard is it to read flash memory off a chip?

What are the parameters in play, and what is a rough estimate of the hardness of the task of reading the contents of flash memory off a microcontroller? Of course, it is assumed that there is no ...
9
votes
3answers
932 views

Is it possible to prevent a physical attack on full disk encryption?

I've been researching into some methods to ensure that disk encryption keys can't be stolen, and one that I've come across is called TRESOR. With this kernel patch, you can create a partition that is ...
-8
votes
1answer
168 views

Viable way to ruin a milk corporation? [closed]

Hack into their system and change the "Sell by" date so that it is immediately bad. How long do you think until they notice, if you pull it off?
3
votes
2answers
186 views

Valid Characters For Magnetic stripe

We bought some Magnetic stripe cards and I'm writing a program that will get talked to by a mag card reader. What I need help with is that I can't, for the life of me, find out what characters are ...
3
votes
2answers
827 views

What are the pros and cons of using a password safe instead of writing passwords on paper?

Many companies have policy again writing passwords and paper and I wonder if there reasoning is sound. Is it always better to use a software password safe than writing passwords on paper? Here are ...
5
votes
3answers
5k views

How easily could be truecrypt and EFS cracked in this scenario

I suspect some info was subtracted in the past months from my laptop. Therefore Im looking for methods to encrypt my data. I want to try using truecrypt for the sensitive files folder plus EFS for ...
4
votes
1answer
516 views

Write-protection at hardware level for security

It seems to me that to maximise server security, one ought - in addition to the usual security measures implemented in software - to prevent the overwriting of certain parts of the server system, such ...
18
votes
2answers
18k views

Disabling/Destroying CCTV/IP Cameras with Lasers?

@D3C4FF has asked a great question and I would like to follow up on that. Basically he had asked whether "[...] an attacker can identify if a CCTV camera is on/operational without direct physical ...
1
vote
0answers
40 views

Advanced research in securing development environment when offered via remote access

With this question I am looking for a direction or suggestions towards advanced research that might be going on currently in designing remote access environments for the development environment(DE) ...
5
votes
2answers
237 views

How to destroy VOIP phone in a proper way?

Are there any standards which consider safe destroying of VOIP phones? I would like to prevent eventual data leakage after devices which have left the company.
-1
votes
1answer
68 views

Network and data security for small online businesses? [closed]

What is the most efficient way of protecting small online business from outside threats. Everything too much expensive is not a solution. I've been looking for good web application firewall and at ...
0
votes
2answers
1k views

Is it possible to install spyware in password protected android phone?

I own samsung galaxy y, an android. I suspect my roommate has installed spyware in my phone. Is it possible to install spyware in password protected android phone ?
1
vote
1answer
355 views

Does a PCI DSS category 2x device require the same physical security as a 1a/b?

I am trying to further understand the scope of my environment. I have a group of category 2x devices that are used to manage a category 1b device through a category 2a device. I understand my group ...
2
votes
0answers
112 views

SAM Card deployment best practice

As part of my current project we will be deploying smart card readers containing SAM cards for decryption purposes. The deployment process involves a third party software integrator who will control ...
27
votes
7answers
4k views

Methods for protecting computer systems from physical attacks

I am interested in cost effective and creative ideas for detecting physical attacks against computer systems. This includes, but is not limited to Tamper Evident security measures. Consider the ...
0
votes
0answers
70 views

Protecting computers from quick physical access attacks [duplicate]

What steps need to be taken to protect a computer from quick attacks that involve physical access? (Note unlike this question, I'm primarily interested in stopping the attacks, not detecting them; ...
4
votes
1answer
164 views

How safe are CD's for Air Gapped computers?

It is often suggested, for air-gapped PC's, to use CD/DVD's as a transfer medium between machines instead of USB sticks or portable hard-drives as it is difficult to write data to a CD/DVD without the ...
1
vote
3answers
275 views

Environmentally friendly ways to destroy hard drives

The best method to prevent others from reading the data on hard drives is to destroy the drives physically: a sledgehammer is a cheap and effective tool to prevent the data from being read again. ...
3
votes
3answers
385 views

Alternate Workstation Lock mechanism

We're all aware of the need for physical security. Everytihng from locks on doors to locking your computer when you leave it. I'm having trouble with some people leaving their stations up as they ...
5
votes
1answer
186 views

What can be done to bridge the Air Gap, except autorun?

What can be done to bridge the Air Gap, except autorun? Is there any hardware butterflies that can attack physically isolated Unix/Linux machine in common usb drives, like VSC (Vendor Specific ...
2
votes
4answers
3k views

Is using Google Voice number for two-factor authentication a big mistake?

Two-factor authentication is growing in popularity as a security measure. For example, Google, Facebook, Twitter, and many other services all have two-step security options today as well as many banks ...
4
votes
2answers
362 views

Is it possible to reliably derive a key from a biometric fingerprint?

Many products (e.g. notebooks, security doors and now smartphones) support some form of fingerprint authentication. That seems simple enough: A trusted system compares a stored representation of a ...
1
vote
1answer
220 views

How much information can be obtained from observing someone type their password?

Seems like it wouldn't be too hard to determine if someone is using all lowercase, special characters, or even the length of their password. In fact, the length might be discovered from audio only. ...
2
votes
1answer
87 views

Web App Protection and Sign On

I have a client that wants to protect access to a web app in case the employee leaves because the app gives access to clients, sales, etc. He wants to "hide" the login credentials to this app and ...
1
vote
0answers
48 views

elapsed time from the time of opening of a container [closed]

Does anybody know of any packaging which measures elapsed time from the time of opening? I have conducted a great deal of research and have found packaging which monitors exposure to temprature and ...
8
votes
2answers
710 views

How do I report a vulnerability to a large organization that doesn't believe it has a problem?

This issue is more political than technical. The organization has a lot of computers that connect via web browser to a central database. Customers are regularly left unattended with physical access ...
2
votes
2answers
245 views

Physically Blocking All PC Ports?

I've got a laptop that is currently 'Air Gapped' that I want to further secure by locking down the USB ports and NIC. I've disabled the NIC from the BIOS, removed the WiFi and bluetooth modules. But I ...
3
votes
2answers
572 views

What to do when GSM/Wifi is jammed and ethernet cables are cut?

So.. There are household alarm systems (to defend against burglars) which send SMS/e-mail alerts if an intruder has been detected or an alert is trigged. However, Mobile networks can be jammed, and ...
3
votes
2answers
346 views

Door locks & deadbolt appropriate for exterior office door with decorative glass next to it

Suppose I have an office door that has decorative glass on one side of the door. The risk to me is that the window pane could be shattered and a gloved hand can manually unlock and open the door from ...
3
votes
2answers
1k views

What risks are there with a Bluetooth based door lock, and are there any mitigations?

There are a few interesting Bluetooth door locks on the market that use version Bluetooth 4.0 however there seems to be a few issues with this E0 Encryption flaws Risks during pairing Attacks ...
0
votes
1answer
185 views

What are techniques for end users to select keys on a smartcard?

When multiple keys exist on a given smartcard, how can a user choose between them for a given identifier ... ideally without a loss of privacy? For example suppose I have a government issued ID that ...
16
votes
3answers
606 views

Risks of Mullions in High Security Areas

I have a storage space full of information assets. The room itself is sound; there are no windows, the walls go all the ceiling, and there is only a single entrance with two good stout doors and high ...
2
votes
3answers
778 views

Cheap door logging for home?

Does someone here knows a cheap DIY door logging system? What I have: - 2 doors that needs to be logged - 1 netbook (running OpenBSD with internet connection & root permissions), the two doors ...
4
votes
2answers
434 views

Preparing for a stolen physical server

What would be the best ways to protect sensitive data stored on a server/drive that gets stolen? The confidentiality of the data is what is important, not retrieving it. Obviously, physical means are ...
30
votes
5answers
2k views

Are there any guidelines for passwords that need to be read out loud?

I recently saw the movie Olympus Has Fallen. Like in many action movies, at the end a missile is launched, and the hero (Mike Banning, played by Gerard Butler) has 60 seconds to recall the launch in ...
2
votes
4answers
803 views

Are malicious scripts in batch files detected by antiviruses?

we have many scripts in shared folders in our IT Department. Are malicious scripts in batch files detected by antiviruses?
4
votes
4answers
778 views

Are keys or RFID tags more secure access control solutions?

Just musing to myself, what is the preferable access control mechanism in high security environments? Locks and Keys or RFID tags? Going under the assumption that the locks/keys are not knoow to be ...
4
votes
2answers
2k views

I am always Hibernating my System, is there any risk for my Encrypted drive with BitLocker?

I am Always Hibernating my Laptop, for faster booting, I encrypted sensitive drive by BitLocker, what if my Laptop stolen and attacker knew that it was in hybernate mode, can he decrypt my hard?
19
votes
5answers
3k views

What is the most security benefit of a clean desk policy?

Starting to study for Security+ using Darril Gibson's book I took the pre-exam and one of the latest questions is “What is the most security benefit of a clean desk policy?” The choices are: ...
6
votes
1answer
105 views

Building access card that has an identification role

The main question is should a building access card have the corporate logo on it? In this organization, the employee ID card is separate from building access card. We currently do not have the logo ...
1
vote
0answers
260 views

Security Features in Bond Paper (Certificate)? [closed]

We are printing certificates and diplomas in bond paper and we found some fraud copy of our certificates. The only feature we have for security is an embossed stamp in GPA, also we have printed 3 ...
4
votes
4answers
2k views

Does a commercially available self destructing HDD (set in BIOS) exist?

Does a self destructing HDD (physically destruction) that will destroy after a certain time exist, or when I use some software to initiate its self-destruction? I guess it need to be set in BIOS or ...