The protection of personnel, hardware, programs, networks, and data from physical circumstances and events.

learn more… | top users | synonyms (1)

3
votes
1answer
2k views

good product to physical lock down a mac mini server?

Since the recent theft of a mac mini and macbook pro Im looking into products to lock down the mac mini server 2011 model. There are many cable solutions out there like kensington but the mac mini has ...
33
votes
9answers
15k views

Are powerline ethernet adapters inherently secure?

I have 2 Zyxel PLA407 powerline adapters. Router is downstairs connected to one adapter, other adapter is upstairs about 30 feet away connected to a desktop. I have a house, not an apartment or ...
7
votes
5answers
1k views

What Man-made Physical Threat Could Pose Severe Danger to a Server Farm?

I am writing a novel in which a researcher attempts to work against a study he is a part of by purposely sabotaging operations on the research compound. I am wondering if the following is plausible. ...
1
vote
1answer
213 views

What is a AUTH-KEY in the security of the computers?

I don't know if this is the right section to post my question and if it is not I apologize. I'm studying security in computers and in particular the URL Spoofing. I understand that a form of URL ...
3
votes
3answers
99 views

How can I prevent someone from carrying out a file from a machine

Assume the following scenario: You have to set up a machine in a way that a user is unable to bring out a certain set of files (or a single file only) from that machine while he has to be able to ...
3
votes
3answers
115 views

Risk when attacker has only physical access to a computer's USB port

Attacker has only access to USB port and can either attach a device or pen-drive to a computer, that can be on or off. Imagine a scenario where non-reliable people have access to offices, either ...
2
votes
0answers
24 views

How do I start securing a virtual appliance to avoid manipulation? [closed]

We have created an amateur software product related with monitoring and management of specific services. It has been made in Python and runs a web service as frontend to show the data in a nice way ...
1
vote
1answer
36 views

Securing sesitive data from developers

I have an enterprise application running that uses both MySQL and Mongodb datastores. My development team all have ssh access to the machine in order to perform application releases, maintenance etc. ...
70
votes
6answers
10k views

Can a lock picker slowly undermine the security of a deadbolt door?

I have a space for computers secured with a simple deadbolt. Someone keeps coming to pick the lock. While working there, I have scared them away three times. There are cameras, but not in useful ...
1
vote
1answer
114 views

Is there is a reason for data-cables shredding?

Just to make sure, is there is a reason for shredding any type of data cables? Is it OK to throw them away just as they are? Thanks.
-2
votes
2answers
69 views

Can I ever hope to be secure using a cell phone or any mobile device? [closed]

I love my phone, it's small, I can bring it everywhere, I can access the wealth of human knowledge online, and do so much more. But with the recent light of the NSA and other world government ...
2
votes
1answer
1k views

How to secure my network, laptop, ipad and email accounts which are possibly hacked?

Background Last month I noticed lots of failed emails in my inbox and after few minutes I lost my access to my Yahoo Mail. My friends informed me that they have received spam emails from me. So I ...
7
votes
5answers
28k views

Can an employer access Whatsapp messages if you are using their servers?

Does anyone know if an employer can access whatsapp messages if you are using their servers? Whatsapp apparently say the messages are encrypted, but I'm not sure about this.
12
votes
6answers
3k views

Does the US government protect its physical internet lines in the US?

It seems like there are lots of ways to prevent man in the middle attacks. I've read many on here and on the rest of the internet. According to wiki you need a secure channel as well to completely ...
0
votes
2answers
98 views

How would you set up a ‘cold’ netbook for master-key signing, large Bitcoin transactions, etc? [closed]

I've just ordered a cheap-o netbook on Amazon, with the intention of installing a Linux distro, and turning it into a permanently-offline high-security machine for sensitive tasks. However, I'm no ...
20
votes
7answers
1k views

Securing the security guy's home office: what should we do?

I read an article in the latest InfoSecurity magazine (an infosec trade rag by Elsevier) saying that us security professionals aren't necessarily taking the correct steps to protect our own home ...
1
vote
1answer
113 views

Could a hardware keylogger be detected through measuring USB micro voltage?

All in all, hardware keyloggers are harder to detect. But if computers can measure the exact voltage consumption of their peripherals, could a hardware keylogger be detected by comparing the normal ...
2
votes
1answer
70 views

From how far away can passive RFID tags be read?

I have been told in the past that with specialized equipment, passive RFID tags could be read at 1100 feet. This seemed a bit far fetched to me, and sure enough, a quick Google search turned up ...
21
votes
6answers
1k views

How to secure a WiFi network?

What do I have to do to secure a WiFi network? Is there any best practices? I have been recommended to use WPA2 encryption on the router, is that enough? What can I do to improve the security even ...
3
votes
2answers
57 views

Could Google Mail or Google Drive work as a path to a company's network?

I am a newbie to data security and would like to ask few questions related to Google Mail and Google Drive. What I want to know is how these two apps could be used to access a company's network AND ...
3
votes
3answers
2k views

is it possible to create a login “key” out of a USB drive?

I was recently thinking about keeping my computer secure from physical access, and i decided that the safest way to keep my data under lock and key, was to do just that: Create a lock and key out of a ...
0
votes
1answer
155 views

Is it a security threat to have food or drink next to computers [closed]

I have never worked in big organization and I wonder if any of them considers food or drinks a security threat. More than one movie showed the scenario of an operator who accidentally spills tea on ...
1
vote
0answers
47 views

Protecting data on a remote device

Background I have am developing a service which consists in a small headless client device (e.g. OLinuXino) which will contain sensitive data. The device will be plugged to a remote network (maybe ...
2
votes
1answer
91 views

Can Polygraphs be effectively 'beaten'? [closed]

This article suggests that polygraphs are rather rudimentary and thus very susceptible to being 'beaten'. In pop culture we see all the time movies where polygraphs are beaten -but with great ...
0
votes
3answers
88 views

Locating a stolen device

Yesterday my friends Samsung Galaxy S3 was stolen. We have found the perpetrator but cannot yet prove anything. He is uploading photos to social media via the phone. Is there any chance to download ...
2
votes
1answer
314 views

Are there HIPAA requirements to encrypt our database hosted in AWS

I'm developing Medical Billing & EHR Software. On completion we are planning to use AWS for hosting and thus provide SAAS. Do we need to encrypt the MySQL database in order to keep HIPAA ...
13
votes
5answers
2k views

How to protect source code locally when traveling with it [duplicate]

I will be traveling abroad for several weeks on a business trip as a consultant. I will carry a laptop with an IDE and all the necessary source code so I can make changes on site (which is the ...
2
votes
2answers
276 views

What are my options for securely printing an OTP Scratchcard?

I want to print and distribute several One Time Passwords (OTPs) that can't be easily disclosed to a 3rd party in transit. (think the physical version of a TLS session for private secrets) To me ...
0
votes
1answer
58 views

Authentication of temporary worker without a badge (physical security) [closed]

In our company we have a procedure to verify internal worker but we cannot use it for temporary worker. We cannot use badges and because of privacy reasons we cannot use any photos. Is there any other ...
0
votes
1answer
145 views

Are all OSes vulnerable to local password reset attacks

It's not that difficult to reset the password of the administrator account in MSWindows when you have local physical access to the machine Same thing applies on any Linux distro, it's possible to ...
0
votes
3answers
332 views

Is there any virus that can cause physical damage [duplicate]

Like damaging a chip on the motherboard, increase the fan's speed till something explodes or anything similar to that. I am not an IT guru but I never came across a malicious code that couldn't be ...
6
votes
2answers
3k views

Safely disable firewire/thunderbolt, patching up DMA exposure

I understand that Firewire 400/800 and Thunderbolt have DMA enabled, and a malicious hardware device can easily read and manipulate system memory at will. If I disable the software drivers for these ...
8
votes
2answers
627 views

How does one evaluate tamper-resistant envelopes/packaging?

In contrast to digital cryptographic algorithms and protocols where many qualified high-IQ individuals dig into the details and specifics, physical tamper resistance for low-tech packages is not ...
2
votes
9answers
1k views

How to secure a public device against abuse? [closed]

What I mean by public device? E.g. in Germany we have small stations to charge cars powered by electricity. This stations are small towers with a flap. Behind the flap are plugs to connect the tower ...
3
votes
1answer
420 views

How many unique house keys can possibly exist?

A Yahoo! answers user suggested that there are 5^5 possible unique configurations for a physical key, but the answer wasn't sourced. I wondered if anyone had similar numbers for how many possible key ...
1
vote
1answer
225 views

Physical vs Logical - Location/Address

According to the CJIS Security Policy - Access Enforcement The information system shall enforce assigned authorizations for controlling access to the system and contained information. The ...
3
votes
4answers
523 views

If an ATM is stolen, how easy can the personal information of the users be recovered?

ATMs get occasionally stolen. How easy would be for the thiefs to retieve the PINs and other information of the users that have previously used the ATM? Is there a periodic wipe of all ...
0
votes
1answer
62 views

Storing data permanently vs temporarily

My lecturer said that since hard disk space is so cheap these days, most organisations do not delete the data on the disk. Rather, they only logically delete it (remove the link to the data). If this ...
1
vote
1answer
128 views

What cellular network is used for automobile theft recovery? Can that be used for PCs and mobile devices?

I'm interested in sending a remote wipe command to stolen IT devices, such as a cell phone, or wifi connected device. However most remote wipe technologies require that the cellular service (or wifi) ...
1
vote
3answers
498 views

Best practices for notebook anti-theft. Computer tracking

I am buying a new Thinkpad with an in-built GPS/Cellular modem. I am thinking what are the best practices for making the notebook secure in case of theft. I am planning to do full disk encryption and ...
-4
votes
6answers
7k views

Will antivirus detect all keyloggers?

Our company schedules Security Training courses for our personnel. In order for us to test them, we develop code such as keyloggers which we email to our personnel to detect stupid personnel, and of ...
9
votes
1answer
215 views

Physical security - responsible disclosure

I recently discovered a way to bypass a commonly used security seal system, requiring no special equipment and taking only a matter of seconds. I feel obliged to disclose this, so as to avoid the ...
0
votes
2answers
712 views

How can I protect myself against programs that turn the webcam on without the indicator light? [duplicate]

Webcams can be turned on without the indicator light: to prevent unwanted use, I wonder whether there exist applications warning that the webcam is being used, or any other kind of protection. ...
0
votes
2answers
65 views

Can a 'fingerprint' file be used to track a stolen device?

A recent laptop theft, as well as concern that the data upon it might be deliberately accessed (on a drive with encryption or not), head lead me to think about how one might retroactively seek to ...
96
votes
12answers
21k views

What's to stop someone from 3D print cloning a key?

My friend just posted a picture of her key to instagram and it occurred to me that with such a high res photo, the dimensions of the key could easily be worked out. Therefore the key could be ...
6
votes
7answers
6k views

Physical computer security, how to disable USB ports when the computer is 'locked'?

Lets say my PC & server is in an environment where a theoretical attacker has physical access to the machine while I'm not there. Now the data is encrypted on the hard drive with TrueCrypt. ...
1
vote
1answer
83 views

Is Domain Logins a potential attack vector?

Say you have a windows server that works as a PDC AD box. Is this a potential Attack Vector for a small 20 people buisness? Wouldn't it be better to simply have an encrypted database file with all the ...
2
votes
3answers
122 views

Securing data on a server

I have a server which has 'loose' physical security (somewhat easy for the entire server to get stolen). For the sake of the question, let's assume that anyone can access the server physically, what ...
-4
votes
5answers
480 views

Why do most cars use physical keys and no PIN?

Why do car makers rely on physical start keys, which can be stolen by home burglars and then used to start the vehicle? Why don't they use more secure methods such as a personal PIN, or a pin code to ...
0
votes
0answers
76 views

ARM Trust ZONE with Normal and Secure World

I am new to Security testing and I am working on 64bit ARM server. We are using ARM TrustZone technology. Is it possible for me to check If i am in Secure world or Normal world. How do I test the ...