The use of physical measures (such as locks and tamper-proofing) or policies (such as Clean Desk) in order to protect sensitive information from unauthorized access.

learn more… | top users | synonyms (1)

6
votes
6answers
488 views
+50

Crash a computer using waves or similar techniques?

I am trying to prevent a potential attack, by first learning how to perform it. Pretend there is a cheap £20 - £50 computer, which an attacker with physical access to wishes to crash. This computer ...
35
votes
6answers
4k views

Secure usb cable for charging in untrusted environments

On a long haul flight, I imagine that charging a phone (in flight mode) with the inbuilt usb port, on the head rest; would be a security risk. Could I mitigate that risk by taking a regular usb cable ...
2
votes
2answers
2k views

Best practices for notebook anti-theft. Computer tracking

I am buying a new Thinkpad with an in-built GPS/Cellular modem. I am thinking what are the best practices for making the notebook secure in case of theft. I am planning to do full disk encryption and ...
5
votes
2answers
136 views

Can I repair a cut-through credit card?

On many cards there's the instruction to, if found, cut it in two pieces and mail them to some address. I'm wondering a bit about the security of this and if I could recover some data. It's not ...
0
votes
0answers
14 views

Can confidential data be gotten from a “hibernation file”? [duplicate]

When a computer hibernates, AFAIK a copy of the RAM is saved into a file on disk. Is this a potential security flaw, knowing someone can take the disk and read the RAM freely?
-3
votes
1answer
81 views

How can I check if someone tampered with the CCTV footage or system?

Recently I was staying in a hotel and I had some very important belongings stolen there in the hotel which is definite. The problem is that no one entered my room after I left the room (2 times for ...
72
votes
8answers
17k views

How is 'Removing RAM' a security risk?

Today I was watching a video on 'Ethical Hacking' where, while discussing hardware attacks, the narrator said: Removing RAM or components from a desktop or a laptop Here's a screenshot: I ...
1
vote
1answer
1k views

What is a AUTH-KEY in the security of the computers?

I'm studying security in computers and in particular the URL Spoofing. I understand that a form of URL spoofing is phishing. Then I read that a countermeasure against phishing is the authentication ...
34
votes
7answers
7k views

Is it possible to improve brute-force guessing of a password with a picture of the keyboard used to enter it?

Is it a bad idea to post a photo of your keyboard to social media? Can I look at a photo of a keyboard and determine the password of an account? Assuming a certain (set of) password(s) is the most ...
0
votes
1answer
80 views

Windows security & data protection

I work for a hotel. The hotel stores a MySQL database online. This database only contains a Reference ID, number of nights and so on, but no private data. No names, no personal information on guests. ...
2
votes
4answers
101 views

Are there any quick-erase devices with a small memory available for storing key information?

I would like to set up my computer's full disk encryption to unlock with a key file (preferably one that uses the SD card interface, but I'm not particularly picky) because it's annoying to enter in ...
5
votes
3answers
199 views

Do you have to ban cellphones and paper to be PCI compliant?

Today I heard of a call centre that you are not allowed to bring cellphones into or take paper out of. This is allegedly to be PCI complaint. Is this true? What is the reasoning? This seems like ...
23
votes
5answers
4k views

Does multiple numbers per button have an effect on security?

I recently came across an electronic deadbolt like this: The keys have multiple numbers per button, 1|2, 3|4, 5|6, 7|8, 9|0 Is there any way that this increases the security of the electronic lock? ...
75
votes
6answers
11k views

Can a lock picker slowly undermine the security of a deadbolt door?

I have a space for computers secured with a simple deadbolt. Someone keeps coming to pick the lock. While working there, I have scared them away three times. There are cameras, but not in useful ...
23
votes
4answers
3k views

What are the alternatives to door passcodes?

Passwords have been a problem since the dawn of computing. They tend to be either so complex that no one can remember them, or so obvious that anyone could guess them. ... Some users ...
3
votes
0answers
27 views

What is the current state of RFID / NFC security?

I'm attempting to do some RFID and NFC cloning and replaying research, as I'm hoping to be able to demo physical security as an attack vector to a few of out clients and prospects. The downside ...
4
votes
1answer
75 views

Wiping magnetic stripe on card with magnet?

I asked a question a while back on using magnets (for example powerful Neodymium ones) to wipe a HDD, and got shown a good article proving it is not possible to wipe data. Pretend I am about to ...
5
votes
2answers
174 views

Mitigating forensic memory acquisition when an attacker has physical access to a workstation

My question regards whether or not the mitigations I use are appropriate for my threat model. Please don't jump to conclusions and say "you need to use locks" or "you can't leave your computer ...
1
vote
0answers
21 views

Can a JTAG device be attached to a running system?

JTAG, or Joint Test Action Group, is a standard for debugging. Many modern motherboards, both on mobile devices and on desktops and workstations have JTAG ports. They allow a CPU to be controlled like ...
0
votes
2answers
110 views

attacks via physical access to USB (dma…?)

I wonder if USB can be exploited by someone with physical access to a reasonably secured computer. For example a kiosk, or laptop attached to a desk. Obviously, boot sequence should be secure (disk ...
6
votes
2answers
199 views

Can motion sensors be disabled by lasers without triggering the alarm?

I remember when I was a kid and was waiting for someone in a long hall, there was a motion sensor and security panel by the door. To kill time, I would go away from the door, then try to move so ...
0
votes
1answer
25 views

Why don't terminal IDs prevent unauthorized entery?

I'm studying for CISSP and had gotten this question wrong. I also found it and the correct answer online, but still don't understand the reasoning. Source Which of the following controls is ...
2
votes
2answers
92 views

Are passport stamps a reliable security feature? [closed]

Most countries in the world still place passport stamps on arrival/departure into the country. Theoretically it is then possibly to calculate the length of a person's stay in a specific country. Is ...
3
votes
4answers
1k views

Are malicious scripts in batch files detected by antiviruses?

We have many scripts in shared folders in our IT Department. Are malicious scripts in batch files detected by antiviruses?
13
votes
4answers
2k views

Is it possible to prevent a physical attack on full disk encryption?

I've been researching into some methods to ensure that disk encryption keys can't be stolen, and one that I've come across is called TRESOR. With this kernel patch, you can create a partition that is ...
11
votes
6answers
10k views

Is it safe to use virtual machines when examining malware?

We want to study for the CEH program and have downloaded 12 DVDs that 6 DVDs are software key-loggers, Trojans, etc. that are all detected by antivirus. This prevents us from examining them and ...
17
votes
3answers
51k views

Can law enforcement track a criminal through dynamic IP address?

I ask because a week ago my home was broken into and, among other things, my iMac computer was stolen. I am desperate to get it back because it has all the pictures of my daughters from the last ...
-4
votes
3answers
107 views

Is there a way to secure a Linux machine in a way that no one else (but me) can access its contents? [closed]

And I mean, even if someone tries rooting with a Live CD, even if one takes the HDD away and plug it in somewhere else, etc... I want to be able to give a client a machine with a service running, but ...
1
vote
1answer
47 views

Location/proximity based decryption using separate machine

I read a long thread where the whole issue was revolving around deriving decryption keys from GPS location. This has huge issues, as being present at a location is not needed to know the location. ...
4
votes
1answer
114 views

Motion sensor door locks

I have seen several offices with electric locks for entry that have a sensor for exit. I assume it's some kind of motion or object detection sensor. This is odd because in many cases, there's a ...
2
votes
3answers
824 views

Is there such thing as a password enforced write protected flash drive?

We would like to provide a flash drive to a client, that they can boot to, which includes a read-only operating system of our own customization, probably Linux. Every boot, it starts from clean slate. ...
34
votes
13answers
7k views

Laptop Anti-Theft Measures

A law firm I've been in contact with has recently been broken into 3 times in the past 4 months. In spite of a number of laptops and other equipment containing sensitive information being stolen, the ...
-10
votes
1answer
243 views

How to protect my laptop screen from being hacked? [closed]

My laptop screen has been hacked, and I think that it is by Van Eck phreaking method. The attackers can see my screen, they are seeing my screen right now. I never even talk to them and these ...
3
votes
1answer
55 views

Information Security on a lost android phone

Recently, my android mobile phone was lost/stolen. I had logged into several applications such as Facebook, Paytm, etc. Thus, there are chances that my personal/ transaction details might be leaked. ...
6
votes
2answers
91 views

What is collusion and how does seperation of duties prevent it, or fail to prevent it?

I'm studying for CISSP and came across the term "collusion". I understand it means when people work together to steal something, but don't quite get it. For example, if two gunmen rob a bank would ...
3
votes
5answers
310 views

How should I store a physical written copy of my password? [duplicate]

I can employ all the fancy encryption and the randomest of passwords to my hard drive, but it won't do me any good if I don't remember how to log in. It seems sensible to write down my password, ...
0
votes
1answer
112 views

Securing a public computer meant for banking

I sometimes visit my bank personally to handle certain formalities. Inside there is a booth containing a computer and all equipment necessary to log in to the online banking service. The computer is ...
104
votes
8answers
19k views

My school wants to keep the details of our door authentication system a secret. Is that a good idea?

So, I am designing a door authentication system (can't really go into more detail) for our school, so that only authenticated persons can go through a certain internal door. They hold that its inner ...
7
votes
4answers
241 views

Must a system be insecure against physical access? If so, why?

Inspired by: Why don't OSes protect against untrusted USB keyboards? Related: What can a hacker do when he has physical access to a system? (I address the points of its main answers below.) There ...
80
votes
14answers
11k views

How can I protect myself from false accusations when our company practices password escrow?

During an internship for a small company, my boss created an account for me, so I generated a password and I used it. The next day, my boss told me to write down the password of my account on a piece ...
11
votes
1answer
734 views

How to apply IT Security knowledge to Home Security?

Today my car got stolen from my house, and it is possible the person who did it has access to my home. I try to take secure measures online to maintain security, yet it seems I never paid attention to ...
2
votes
2answers
212 views

Securing physical access to your internet connection? (Apartment Utility Box)

I recently moved to a new apartment complex, had my DIY Time Warner box ready to go and hooked up my all my hardware. Everything booted fine but no connection to TW. I tested all the jacks in the ...
3
votes
1answer
57 views

Loss of physical locks/password to safes

Safes can keep important information like part of a dual control password, smartcards and pendrives, and so on. What would be the best practices to prevent loss or damage to a physical locks to a ...
1
vote
0answers
41 views

What else can I do to protect my accounts? [closed]

I am trying to make sure all my accounts are secure from unauthorised access and have turned on all security measures that I can find to make sure my stuff is protected. Here is what I have in place: ...
-3
votes
2answers
90 views

Defense in depth

How is defense in depth strategy different from network security policy? What is the need to name it a "Defense In Depth", although you may simply name it "Network security policy"? Secondly if DID ...
3
votes
2answers
85 views

Shutdown if case opened

Assume the user has a full disk encrypted HDD in which their OS and files reside. They also have made attaching USB or any other device without first allowing it cause an automatic shutdown which ...
2
votes
2answers
458 views

What are my options for securely printing an OTP Scratchcard?

I want to print and distribute several One Time Passwords (OTPs) that can't be easily disclosed to a 3rd party in transit. (think the physical version of a TLS session for private secrets) To me ...
13
votes
2answers
390 views

What does banking etc. server room protection look like? What happens if it fails?

Given that information security is derived from physical security, as evidenced by this theft, I'm curious as to what protection surrounds my bank account? There are two main avenues I'm interested ...
54
votes
8answers
6k views

Why would security cover things like natural disasters?

I'm taking a course which is designed with the CISSP certification in mind. Though the class is categorized as software engineering, we talked a lot about physical security and, in particular, floods, ...
2
votes
0answers
27 views

Reasonable means of security in commercial dealings [closed]

I am writing a paper from a legal standpoint and I'm suggesting legislation for a new duty of care for private companies in the safeguarding of customer's personal information. This will not apply to ...