The use of physical measures (such as locks and tamper-proofing) or policies (such as Clean Desk) in order to protect sensitive information from unauthorized access.

learn more… | top users | synonyms (1)

1
vote
0answers
137 views

Protecting data on a remote device

Background I have am developing a service which consists in a small headless client device (e.g. OLinuXino) which will contain sensitive data. The device will be plugged to a remote network (maybe ...
2
votes
1answer
107 views

Can Polygraphs be effectively 'beaten'? [closed]

This article suggests that polygraphs are rather rudimentary and thus very susceptible to being 'beaten'. In pop culture we see all the time movies where polygraphs are beaten -but with great ...
0
votes
3answers
97 views

Locating a stolen device

Yesterday my friends Samsung Galaxy S3 was stolen. We have found the perpetrator but cannot yet prove anything. He is uploading photos to social media via the phone. Is there any chance to download ...
2
votes
1answer
1k views

Are there HIPAA requirements to encrypt our database hosted in AWS

I'm developing Medical Billing & EHR Software. On completion we are planning to use AWS for hosting and thus provide SAAS. Do we need to encrypt the MySQL database in order to keep HIPAA ...
14
votes
5answers
2k views

How to protect source code locally when traveling with it [duplicate]

I will be traveling abroad for several weeks on a business trip as a consultant. I will carry a laptop with an IDE and all the necessary source code so I can make changes on site (which is the ...
0
votes
1answer
119 views

Authentication of temporary worker without a badge (physical security) [closed]

In our company we have a procedure to verify internal worker but we cannot use it for temporary worker. We cannot use badges and because of privacy reasons we cannot use any photos. Is there any other ...
0
votes
1answer
160 views

Are all OSes vulnerable to local password reset attacks

It's not that difficult to reset the password of the administrator account in MSWindows when you have local physical access to the machine Same thing applies on any Linux distro, it's possible to ...
9
votes
2answers
1k views

How does one evaluate tamper-resistant envelopes/packaging?

In contrast to digital cryptographic algorithms and protocols where many qualified high-IQ individuals dig into the details and specifics, physical tamper resistance for low-tech packages is not ...
2
votes
9answers
2k views

How to secure a public device against abuse? [closed]

What I mean by public device? E.g. in Germany we have small stations to charge cars powered by electricity. This stations are small towers with a flap. Behind the flap are plugs to connect the tower ...
1
vote
1answer
888 views

Physical vs Logical - Location/Address

According to the CJIS Security Policy - Access Enforcement The information system shall enforce assigned authorizations for controlling access to the system and contained information. The ...
0
votes
1answer
109 views

Storing data permanently vs temporarily

My lecturer said that since hard disk space is so cheap these days, most organisations do not delete the data on the disk. Rather, they only logically delete it (remove the link to the data). If this ...
1
vote
1answer
151 views

What cellular network is used for automobile theft recovery? Can that be used for PCs and mobile devices?

I'm interested in sending a remote wipe command to stolen IT devices, such as a cell phone, or wifi connected device. However most remote wipe technologies require that the cellular service (or wifi) ...
-5
votes
6answers
12k views

Will antivirus detect all keyloggers?

Our company schedules Security Training courses for our personnel. In order for us to test them, we develop code such as keyloggers which we email to our personnel to detect stupid personnel, and of ...
9
votes
1answer
253 views

Physical security - responsible disclosure

I recently discovered a way to bypass a commonly used security seal system, requiring no special equipment and taking only a matter of seconds. I feel obliged to disclose this, so as to avoid the ...
1
vote
2answers
1k views

How can I protect myself against programs that turn the webcam on without the indicator light? [duplicate]

Webcams can be turned on without the indicator light: to prevent unwanted use, I wonder whether there exist applications warning that the webcam is being used, or any other kind of protection. ...
0
votes
2answers
135 views

Can a 'fingerprint' file be used to track a stolen device?

A recent laptop theft, as well as concern that the data upon it might be deliberately accessed (on a drive with encryption or not), head lead me to think about how one might retroactively seek to ...
6
votes
7answers
8k views

Physical computer security, how to disable USB ports when the computer is 'locked'?

Lets say my PC & server is in an environment where a theoretical attacker has physical access to the machine while I'm not there. Now the data is encrypted on the hard drive with TrueCrypt. ...
1
vote
1answer
112 views

Is Domain Logins a potential attack vector?

Say you have a windows server that works as a PDC AD box. Is this a potential Attack Vector for a small 20 people buisness? Wouldn't it be better to simply have an encrypted database file with all the ...
2
votes
2answers
151 views

Securing data on a server

I have a server which has 'loose' physical security (somewhat easy for the entire server to get stolen). For the sake of the question, let's assume that anyone can access the server physically, what ...
-2
votes
5answers
994 views

Why do most cars use physical keys and no PIN?

Why do car makers rely on physical start keys, which can be stolen by home burglars and then used to start the vehicle? Why don't they use more secure methods such as a personal PIN, or a pin code to ...
8
votes
2answers
396 views

Building's server room is unlocked: What danger is my building in?

In one of the buildings I work in, there are lawyers and accountants, web developers and marketers, and numerous other small businesses. Everyone's (shared) internet is routed through the same server ...
1
vote
1answer
100 views

Is there a value in using portable programs on a USB key?

If I am working writing a text document in a text editor (say notepad or MS word, or ...) then I can save the file and the encrypt this file. I can then try to erase the original file by overwriting ...
2
votes
8answers
1k views

Finding Hidden Keylogger Through Forcing a Computation Error

It must be possible to detect keylogging by close scrutiny of timing between physical keystroke execution and the character's eventual occurrence on the screen. I've had a friend show me this with ...
3
votes
1answer
115 views

What can be done to prevent disruption of hardware in the event of a powerful solar flare?

I'm under the impression that a sufficiently powerful solar flare can temporarily disrupt and even damage electronics. Are there any practical approaches that one could take to minimize this ...
3
votes
3answers
3k views

Finding hidden cameras

Let's say Alice, Bob, and Mallory all live together in a house. Mallory decides to go on vacation, but before leaving, she decides to play a game with Bob and Alice. She makes two claims: She has ...
1
vote
1answer
653 views

valid PDF signature without using hardware HSM or usb Token

I have a DMS system(alfresco) that needs to sign approx 50.000 valid signatures a year. The signing certificate needs to be acquired from one of the affiliated sub-CA's. So according to the Adobe CDS ...
1
vote
1answer
152 views

Protecting data on an embedded device

I am to release a system-on-chip device that, during its lifetime, will come to store sensitive data. I want to make that data hard to extract or duplicate. Encrypting is good for dealing with MiTM, ...
-9
votes
1answer
271 views

Viable way to ruin a milk corporation? [closed]

Hack into their system and change the "Sell by" date so that it is immediately bad. How long do you think until they notice, if you pull it off?
3
votes
2answers
506 views

Valid Characters For Magnetic stripe

We bought some Magnetic stripe cards and I'm writing a program that will get talked to by a mag card reader. What I need help with is that I can't, for the life of me, find out what characters are ...
3
votes
2answers
2k views

What are the pros and cons of using a password safe instead of writing passwords on paper?

Many companies have policy again writing passwords and paper and I wonder if there reasoning is sound. Is it always better to use a software password safe than writing passwords on paper? Here are ...
5
votes
3answers
6k views

How easily could be truecrypt and EFS cracked in this scenario

I suspect some info was subtracted in the past months from my laptop. Therefore Im looking for methods to encrypt my data. I want to try using truecrypt for the sensitive files folder plus EFS for the ...
4
votes
1answer
1k views

Write-protection at hardware level for security

It seems to me that to maximise server security, one ought - in addition to the usual security measures implemented in software - to prevent the overwriting of certain parts of the server system, such ...
24
votes
2answers
61k views

Disabling/Destroying CCTV/IP Cameras with Lasers?

@D3C4FF has asked a great question and I would like to follow up on that. Basically he had asked whether "[...] an attacker can identify if a CCTV camera is on/operational without direct physical ...
1
vote
0answers
47 views

Advanced research in securing development environment when offered via remote access

With this question I am looking for a direction or suggestions towards advanced research that might be going on currently in designing remote access environments for the development environment(DE) ...
5
votes
2answers
330 views

How to destroy VOIP phone in a proper way?

Are there any standards which consider safe destroying of VOIP phones? I would like to prevent eventual data leakage after devices which have left the company.
-1
votes
1answer
80 views

Network and data security for small online businesses? [closed]

What is the most efficient way of protecting small online business from outside threats. Everything too much expensive is not a solution. I've been looking for good web application firewall and at ...
1
vote
1answer
1k views

Does a PCI DSS category 2x device require the same physical security as a 1a/b?

I am trying to further understand the scope of my environment. I have a group of category 2x devices that are used to manage a category 1b device through a category 2a device. I understand my group ...
32
votes
7answers
7k views

Methods for protecting computer systems from physical attacks

I am interested in cost effective and creative ideas for detecting physical attacks against computer systems. This includes, but is not limited to Tamper Evident security measures. Consider the ...
0
votes
0answers
78 views

Protecting computers from quick physical access attacks [duplicate]

What steps need to be taken to protect a computer from quick attacks that involve physical access? (Note unlike this question, I'm primarily interested in stopping the attacks, not detecting them; ...
5
votes
1answer
232 views

How safe are CD's for Air Gapped computers?

It is often suggested, for air-gapped PC's, to use CD/DVD's as a transfer medium between machines instead of USB sticks or portable hard-drives as it is difficult to write data to a CD/DVD without the ...
1
vote
3answers
516 views

Environmentally friendly ways to destroy hard drives

The best method to prevent others from reading the data on hard drives is to destroy the drives physically: a sledgehammer is a cheap and effective tool to prevent the data from being read again. ...
3
votes
3answers
900 views

Alternate Workstation Lock mechanism

We're all aware of the need for physical security. Everytihng from locks on doors to locking your computer when you leave it. I'm having trouble with some people leaving their stations up as they ...
2
votes
4answers
8k views

Is using Google Voice number for two-factor authentication a big mistake?

Two-factor authentication is growing in popularity as a security measure. For example, Google, Facebook, Twitter, and many other services all have two-step security options today as well as many banks ...
8
votes
2answers
725 views

Is it possible to reliably derive a key from a biometric fingerprint?

Many products (e.g. notebooks, security doors and now smartphones) support some form of fingerprint authentication. That seems simple enough: A trusted system compares a stored representation of a ...
1
vote
1answer
294 views

How much information can be obtained from observing someone type their password?

Seems like it wouldn't be too hard to determine if someone is using all lowercase, special characters, or even the length of their password. In fact, the length might be discovered from audio only. ...
2
votes
1answer
93 views

Web App Protection and Sign On

I have a client that wants to protect access to a web app in case the employee leaves because the app gives access to clients, sales, etc. He wants to "hide" the login credentials to this app and ...
1
vote
0answers
56 views

elapsed time from the time of opening of a container [closed]

Does anybody know of any packaging which measures elapsed time from the time of opening? I have conducted a great deal of research and have found packaging which monitors exposure to temprature and ...
9
votes
2answers
781 views

How do I report a vulnerability to a large organization that doesn't believe it has a problem?

This issue is more political than technical. The organization has a lot of computers that connect via web browser to a central database. Customers are regularly left unattended with physical access ...
2
votes
2answers
450 views

Physically Blocking All PC Ports?

I've got a laptop that is currently 'Air Gapped' that I want to further secure by locking down the USB ports and NIC. I've disabled the NIC from the BIOS, removed the WiFi and bluetooth modules. But I ...
3
votes
2answers
1k views

What to do when GSM/Wifi is jammed and ethernet cables are cut?

So.. There are household alarm systems (to defend against burglars) which send SMS/e-mail alerts if an intruder has been detected or an alert is trigged. However, Mobile networks can be jammed, and ...